Check :drop_user permission before showing link

Even though the controller action is protected, we should only
show the link if a user has the permission.
vertical-align roster table cells