Migrate authorisation logic to Cancan

*excuse me for not being able to organise my commits properly in this PR.*
please use the branch diff view if it's getting too confusing.

before we create the Organisation Admin role,
we should have a framework in place for authorisation.

enter Cancan.

new to cancan ?

[Cancan wiki](https://github.com/ryanb/cancan/wiki)
[Defining abilities](https://github.com/ryanb/cancan/wiki/Defining-Abilities)
[Controller authorisation example](https://github.com/ryanb/cancan/wiki/Controller-Authorization-Example)