User roles

I ended up using rolify and pundit to describe roles and authorization. This implements policies and roles, but at the moment only partially implements checking them in controllers.