basic user management added

# What is this?

This PR enables existing users of the tracker app to approve other users.

New users that sign up and unapproved by default an must be approved by an existing user.

# Cool, any gotchas?

Not really, most of the code was got from the [Devise wiki](https://github.com/plataformatec/devise/wiki/How-To%3a-Require-admin-to-activate-account-before-sign_in) and some specs were updated/added to support the new behaviour.