Fetch recordings via ajax only when the user's authorized, refs #804

When the user goes to the recording list, an ajax is triggered to updated
the recordings db for the target room. This is now done only when the user
has permissions to do so.
Add tests for abilities for Bigbluebutton models, refs #804

Testing these abilities in models is faster and cleaner than testing in
controllers. The tests for abilities that are currently in the controllers
might be simplified soon.
Anon users can view recordings in public spaces, refs #804
Replace can_record_meeting? and can_create_meeting? by cancan, refs #804

These methods were in the model User and were now replace by CanCan.