Refactoring ability to split privileges in a separate class per role, plus some convenience methods to overcome cancan limitations