Authorisation for all controllers, but Devise