Bump cancancan version, optimize rules

Since all rules are always evaluated on every request, comparing against
Document.shared meant that all shared documents were requested for all
requests. Pretty bad!