Before saving your meta data, you have if ( ! current_user_can( '' ) ) return
I’ve never run current_user_can against and empty string of capabilities, so I’m not sure what your results are going to be, but it’s very possible this returns a false, and you return at this point.
Also, be sure you sanitize your $_POST data before sticking it in the database.