Switch to role based permissions

Rather than having an object on the permissions model which contains the
list of abilities and boolean flags enabling them, we simply give each
permission row a 'role' attribute. This is then checked in the code
using the connect-roles module.

The advantage of doing it this way is that we can freely add new
abilities without having to go through the database and update
permission rows to reflect them. Similarly we can add new roles if
needed and then define the abilities for those roles in the code.