Write tests for Ability

[esoterik]

We currently rely on our controller specs to test permissions; it'd be much better if we tested ability.rb directly.

[orenyk]

Nice, that actually makes a lot of sense, and then we'd simply mock the various can? methods in the other specs to verify that we're handling authorization properly. Good idea!