User authorization

Using Gem cancancan.
See models/ability for implemented rules.

Relies on authorisation, so it should be merged after user_auth.