check for superclass to match permissions, too

I think this is what users expect - at least I did and wondered what
was wrong.

```
class A
end

class B < A
end

can :read, A

can? :read, B # => true, without this: false
```