add request model, requestor role, define abilities for it, specs
refactor ability specs
expose create request through api, model, specs