Add more roast tests

Specifically, for PATCH and DELETE requests. Add a CanCan authorize!
action before destroy is called.