Potential security hole authorising modules in CanCan

Just some thoughts on how CanCan didn't work as I expected. Whether design or bug, it's worth checking out how modules are handled.