Make it possible to serve /auth/failure

/auth/failure could never be served as a result of the "before" block. Refactor
the mechanism by which the auth wrapper determines what to forward and what to
serve itself, and make /auth/failure actually throw a 401.
Add bundler paths to gitignore
Only allow users with "signin" permission to login

Previously, AuthWrapper allowed any authenticated user to log in, meaning that
the "can sign in?" checkbox in signon didn't do anything. This commit makes
AuthWrapper pay attention to the "permissions" object in the OAuth payload, and
denies access to users without the appropriate permission.

Also add some tests for AuthWrapper that use Rack::Test.