User roles

I ended up using rolify and pundit to describe roles and authorization. This implements policies and roles, but at the moment only partially implements checking them in controllers. 
Do we want a global rescue block with a 401 status ala https://github.com/elabs/pundit#rescuing-a-denied-authorization-in-rails