Added cancan for access control, changed Role#permissions

* Role#permissions is an json datatype, not hstore (json was the original intention)
* cancan Ability class checks Role#permissions when setting what the current_user can(not) do
* binstubs generated by rails/spring
* existing migration changed instead of new one created because the project is still early and the db can be dropped/created easily
Rspecs create models via let() instead of before(:each)
Refactor Ability model for nicer permission processing