One support email on error_message and requires_admin state

This fixes #394.

This took me a *whole* lot longer to do than I ever expected :-(

The RequestController sure does have a whole lot of logic in the controller. It took me a long time to unravel and understand what a single action (RequestController#describe_state) was doing.

In the process, I improved the test coverage, refactored a whole bunch of methods, and went down some blind alleys that got reverted that you can also see here.

I added a new class "Ability" that could capture who can do what (kind of in the model of the CanCan gem). I resisted the temptation (for the time being) to try to move code that is scattered between the User and InfoRequest model (and probably some others) there.

To implement a fine-grained permission system (#73) would be about extending Ability.