More authorization related changes:

1) Reintroduces authorization stuff for front-end controllers from
spree_auth_devise.
2) Admin::BaseController now passes the class and not a new instance
Add specs to cover authorization on CheckoutController
Drop admin user controller