https://churchm.ag/cancan-for-easy-role-authorization-in-rails/