complete replacement of CanCan for admin/roles Fixes #62