Add role-based authorization

Closes #3.
I'm not sure this is right. We don't have any reason for vendors to view the index page here do we? Every other action is restricted to Administrator so anything they want to do will fail unless I'm forgetting something.