permissions using cancan, vips can read everything, nobody else can do anything (admins can manage all). closes #8