Use CanCanCan for user_roles auth