ruby on rails - Using Devise/Cancan/Rolify together -

i'm trying set authorization/authentication system, , i'm getting confused, have couple of questions:

1. in lot of tutorials, people set user/role habtm relationship. allows each user have multiple roles, if want each user have 1 role, necessary? if want have options "active" , "inactive" users, should roles or else?
2. in cancan wiki, says if want 1 user have 1 role, should make attribute , use "can :manage, :all if user.role == "admin"", isn't dangerous because each time "admin" string? matter? what's better way deal this?

i've tried best read through documentation involved , started tutorial

http://railsapps.github.com/tutorial-rails-bootstrap-devise-cancan.html

although i've read http://starqle.com/articles/rails-3-authentication-and-authorization-with-devise-and-cancan-part-1/ , tonyamoyal.com/2010/09/29/rails-authentication-with-devise-and-cancan-part-2-restful-resources-for-administrators/

i can't work way want to. how do this?

1. not need multiple roles or role table

cancan agnostic how define roles in application. have role field in user model.

as "active" , "inactive" users, have 2 options. have field status, or have "inactive" role , consider other role "active". depends on mean "active" , how using information in application.

2. there nothing wrong storing user's role in string.

the fact role stored string doesn't make less safe. should, however, use attr_protected prevent mass assignment of user role.

attr_protected :role 

that way, users won't able update own roles.