Cancancan

Completes #51 
Uses CanCan for almost all authorization to eliminate a bunch of before_filters