Added custom :discover ability to local Ability class, mimicking the way Hydra::Ability and Hydra::PolicyAwareAbility works.
ThumnailController#can_download? customized to require :discover permission on asset.
Tests added for direct and inherited object permissions.