moving HTTP_REMOTE_USER checking into devise strategy and removing it from application controller.  fixes #8976