fixes _userinfo bug for non GH users
fixes security issue: destroy experiments

controller now checks if the edited experiment actually belongs to
current_user (or current_user is_admin)
adds visibility option to new experiments
minor: uses current_user instead of session[]
adds a link to delete Exp.Runs
saves the Exp.Run log as valid json

this closes #13