replace an explicit @roles check with a cancan authorize! check