Factor abilities methods

in app controller, user model and services.

Same code repeated 3 times.

Same behavior, less lines, and slightly more time efficient since:

- a single `@abilities` is constructed once for the entire app
- no more `add_abilities` filter before every action of the app, yay!