按照文档上写的，遇到个问题

Controller 内容如下：

class DepartmentsController < ApplicationController
  before_action :set_department, only: [:show, :edit, :update, :destroy]
  load_and_authorize_resource

Ability 文件如下：

class Ability
  include CanCan::Ability

  def initialize(user)
    # Define abilities for the passed in user here. For example:
    #
      user ||= User.new # guest user (not logged in)
      if user.admin?
        can :manage, :all
      elsif user.blank?
        can :read, :Department
      else
        can :manage, :Department
        cannot [:destory,:update], :Department
      end

现在问题是，用户角色都获取正确，admin 角色没问题，但是 user 角色的没有 Department 的任何权限，load_and_authorize_resource 这句话写了就如此，是有别的什么地方遗漏了么？rails 4.2.3 cancancan2.0, 查了好多文章没发现有什么明显的错漏