Switches to CanCan for RBAC

 - moved all of the access control primitives into app/models/ability.rb
 - updated controllers to use CanCan's load_and_authorize_resource