replace an explicit @roles check with a cancan authorize! check
Add 'superadmin' role who can managed everything
Add exhibits#destroy; fixes #382