workaround to known bug of CanCan and StrongParameters
navbar, menu based on user abilities, add 403 page