Handling CanCan filters and use lower level cookie lookup.

Two small changes we've needed that we think are backward compatible.

1) [CanCan](https://github.com/ryanb/cancan) filter skipping. The Accept action is generally for new users, so we should skip CanCan authorisation if present.
2) A lower level cookie lookup. We were getting errors using the default _cookies_ method, but going via the request object works. 

H