Controller filters and related bugs

Please take a look... Especially the c8cea43 is quite painful because all the `'before_` results across all the controllers failed on non-ok values (thus everywhere where the authorization is required).