add CanCan and RoleModel

- ability model
- changes to tests to make them auth-aware
- add role to user factory
- roles_mask column to Ability