Spike cancan

Controller security (https://www.pivotaltracker.com/story/show/39758311) implemented using CanCan. Not really a spike (though it briefly began as one.)