Add RSpec matchers for model permissions

Closes #137. Although I think it'd also be nice to have matchers
for controllers at some point. Also fixes user group test.