[WIP] Factor abilities methods

in app controller, user model and services.

Same behavior, less lines, and slightly more time efficient since a single `@abilities` is constructed and maintained.