Big refactor from AR to Mongo and

Declarative Authorization to Pundit and a lot of refactoring along
the way.

My apologies for the specs. They're gonna need some work.