Use CanCanCan for notes authorization