fix all specs, default role to already active role (to be changed when admin system is ready), add flash, fix login form, add form helpers, fix order delete route permissions, add permissions to other routes