Cancancan

Completes #51 
Uses CanCan for almost all authorization to eliminate a bunch of before_filters
Also fixes FriendlyId so that you can always use ```User.find params[:id]```
Now we have rock-solid authorization! I think