Add 'superadmin' role who can managed everything
Add exhibits#destroy; fixes #382
replace an explicit @roles check with a cancan authorize! check