Feature/key cards

This represents three pieces of work.

1) Add keycards to the reservation form - including applicable staff/admin permissions.
2) Add CanCan for centralizing permissions.
3) Adjust specs to test for staff permission rather than admin.