move authorisation out of ApplicationController

Commit f15311c027 moved authorisation into ApplicationController, which had the unfortunate side-effect of breaking SSO functionality (eg being able to assign new perms to users). The reason for that `gds-sso` controllers extend `ApplicationController` and hence broke because they didn't implement authorisation.

A [pull request](https://github.com/alphagov/gds-sso/pull/28) has been raised to fix the underlying issue, but while that request is merged (and the work needed to bump the `gds-sso` gem to the latest  version is carried out), this is a workaround to make the app work again.