Fix the authorize test and remove UnauthenticatedWidgySite

This test has not been testing anything for a while, because passing
HTTP_COOKIE to the test-client methods was overriding the test client's
cookies, including the session that had a logged-in user. The test
verified that a 403 was being returned, but the 403 wasn't from where we
expected (the UnauthenticatedWidgySite). Also, UnauthenticatedWidgySite
was overriding `authorize`, which doesn't exist any more. The new method
is called `authorize_view`, but this wasn't detected because the test
isn't robust enough.

This patch mocks widgy_site.authorize_view method to ensure it's called,
instead of relying on the PermissionDenied exception. This also allows
us to get rid of UnauthenticatedWidgySite.