fix ApplicationController#check_session to return bool, fix #xhtml to use tidy_bytes in RSS
add ApplicationController#authorized_to_show_user? spec