Remove acl9, replace with SimpleRole

acl9 gem is a little bit opaque, had (at least one) rails 4.1.x incompatibility, and its tests are written in a convluted style with Test::Unit. Since our needs are simple (see what I did there?), rewrite, as SimpleRole, only implementing the methods that we use, and hardcoding (would be simple to generalize, but there is no need) class names for associations.
I think we should remove the owner relation, because we're mainly using it to authorise, and that's what roles are for. At some point we'll do other kinds of owner (e.g. organisations) and we can revisit then.