added cancan for authorisation
added user settings page, added route for /settings