Authorization

Turned out to be a bit more work than we expected but a long train ride later and it looks ok.  I'll have a play around in dev soon but the tests pass.
In the users_controller I removed the 'owner' role and replaced with 'manager'.  Not sure what the roles table looks like in prod so maybe we should add some methods for 'authorize_owner'.

Cheers!