fixes #2 - roles and access

poorly ensures that top three roles have access to users via the UserPolicy. This will get cleaned up as I learn more about pundit.