```ruby
class Admin < ActiveRecord::Base
  # Include default devise modules. Others available are:
  # :confirmable, :registerable, :lockable, :timeoutable and :omniauthable
  devise :token_authenticatable, :database_authenticatable,
         :recoverable, :rememberable, :trackable, :validatable

  # Setup accessible (or protected) attributes for your model
  attr_accessible :email, :password, :password_confirmation, :remember_me
  attr_accessible :role_ids

  before_save :ensure_authentication_token

  has_many :assignments, dependent: :destroy
  has_many :roles, through: :assignments
end
```

Add validation for role for new users. Note: there is still a bug when a user doesn't have a role assigned, which results in an infinite loop when they log in. This is because the root_url is /validations, which is limited to project_participants and above, and CanCan redirects to root_url on AccessDenied exceptions. This shouldn't be an issue if the website is managed properly, but that's not gone well in the past.
user
```ruby
class Admin < ActiveRecord::Base
  # Include default devise modules. Others available are:
  # :confirmable, :registerable, :lockable, :timeoutable and :omniauthable
  devise :token_authenticatable, :database_authenticatable,
         :recoverable, :rememberable, :trackable, :validatable

  # Setup accessible (or protected) attributes for your model
  attr_accessible :email, :password, :password_confirmation, :remember_me
  attr_accessible :role_ids

  validates :role_ids, presence: true

  before_save :ensure_authentication_token

  has_many :assignments, dependent: :destroy
  has_many :roles, through: :assignments
end
```
assistant