Factor abilities methods

in app controller, user model and services.