User roles

I ended up using rolify and pundit to describe roles and authorization. This implements policies and roles, but at the moment only partially implements checking them in controllers. 
Yes we should also probably add a handler for doorkeeper as well https://github.com/doorkeeper-gem/doorkeeper/wiki/Customizing-the-response-body-when-unauthorized, and make them the same.