Add tests for more controllers (gh #35)

Also update to use cancancan, of authorization management.