Use cancancan to authorize user_preference_controller