#58 - Ability tests

- Refactor ability_spec, organized by type of user, then by model permissions
- Add tests for untested functionality