User roles

I ended up using rolify and pundit to describe roles and authorization. This implements policies and roles, but at the moment only partially implements checking them in controllers. 
Yes. I was looking into how to make them work with RestPack, which I think that can just take a second argument that's an ActiveRecord scope.