Add p3p header to DocumentsController#show

Move the set_p3p_header method from authentications controller to a
protected method on the application controller so it can be shared
between all controllers who may be embedded in an iframe.

This should provide a solution for issue #39