user: add role_id
users_controller: limit 'destroy' action to admins

Regular users can still see the 'Destroy' link next to each user in
`fido/users`, but it is a NOP for them.
user: add default value setting callback

Users are always set to the default role of "author" (regular user)
before they are saved into the database.

It's probably not idiomatic Rails to put in `ROLE_AUTHOR` as a constant
and use that here; it'd be much better to use `ROLE_AUTHOR` in the
seeds.rb file also.