Manage users

Add ability for users to manage other users depending on their roles.  Highlights of this pull request are:

* Merged Hydra::Ability and CanCan::Ability so that CanCan manages both ActiveRecord and ActiveFedora objects.  This is necessary because users need to CRUD Users (ActiveRecord) and CRUD Aptrust Objects (ActiveFedora).
* Defined abilities depending on the three roles: admin, institutional_admin and institutional_user
* Fixed various display issues.
* Created more robust header utility links based on authentication and authorization.