Fix what_a_user_can_see concern

We should use has_role? because that checks against roles instead of
affiliations which ensures everything you are comparing against is a
symbol.