Closes #3 - Added tests for `user.can()`, `user.promote()` (skipped), `User.withAccess()` including inheritance.