fixes #2275 - include ThreadSession::Cleaner only once

Foreman::ThreadSession::Cleaner was included in Taxonomy concern, which
postponed the session clearing (that should be the first thing to happen in
filters) to phase after :authorize filter, effectively discarding the login
information leading to permission denied.

The ThreadSession::Cleaner should be included only in Api::BaseController.