move admin/users to be accessed only by site admins

app/models/admin_ability.rb

@@ -18,7 +18,6 @@ class AdminAbility
   end
 
   def common_abilities_for_roles(user)
-    can :manage, User, id: user.id
     can :manage, Registration, user_id: user.id
 
     can :index, Conference

spec/features/cfp_ability_spec.rb

@@ -269,6 +269,12 @@ feature 'Has correct abilities' do
       visit edit_admin_conference_resource_path(conference.short_title, conference.resources.first)
       expect(current_path).to eq(edit_admin_conference_resource_path(conference.short_title, conference.resources.first))
 
+      visit admin_users_path
+      expect(current_path).to eq(root_path)
+
+      visit admin_user_path(user_cfp)
+      expect(current_path).to eq(root_path)
+
       visit admin_revision_history_path
       expect(current_path).to eq(root_path)
     end

spec/features/info_desk_ability_spec.rb

@@ -237,6 +237,12 @@ feature 'Has correct abilities' do
       visit admin_conference_program_tracks_path(conference.short_title)
       expect(current_path).to eq(root_path)
 
+      visit admin_users_path
+      expect(current_path).to eq(root_path)
+
+      visit admin_user_path(user_info_desk)
+      expect(current_path).to eq(root_path)
+
       visit admin_conference_emails_path(conference.short_title)
       expect(current_path).to eq(root_path)
     end

spec/features/organizer_ability_spec.rb

@@ -266,6 +266,12 @@ feature 'Has correct abilities' do
       visit edit_admin_conference_resource_path(conference.short_title, conference.resources.first)
       expect(current_path).to eq(edit_admin_conference_resource_path(conference.short_title, conference.resources.first))
 
+      visit admin_users_path
+      expect(current_path).to eq(root_path)
+
+      visit admin_user_path(user_organizer)
+      expect(current_path).to eq(root_path)
+
       visit admin_revision_history_path
       expect(current_path).to eq(admin_revision_history_path)
     end

spec/models/admin_ability_spec.rb

@@ -64,6 +64,10 @@ describe 'User with admin role' do
       it{ should_not be_able_to(:edit, Role.find_by(name: 'organization_admin', resource: other_organization)) }
       it{ should_not be_able_to(:show, Role.find_by(name: 'organization_admin', resource: other_organization)) }
 
+      it{ should_not be_able_to(:new, User.new) }
+      it{ should_not be_able_to(:create, User.new) }
+      it{ should_not be_able_to(:manage, User) }
+
       %w[organizer cfp info_desk volunteers_coordinator].each do |role|
         it{ should_not be_able_to(:toggle_user, Role.find_by(name: role, resource: other_conference)) }
         it{ should_not be_able_to(:update, Role.find_by(name: role, resource: other_conference)) }