move authorisation out of ApplicationController

Commit f15311c027 move authorisation into ApplicationController,
which had the unfortunate side-effect of breaking SSO functionality
(eg being able to assign new perms to users). The reason for that
'gds-sso' controllers extend ApplicationController and hence broke
because they didn't implement authorisation.

A pull request (https://github.com/alphagov/gds-sso/pull/28) has
been raised for the underlying issue, but in the meantime, this
is a workaround to make the app work again.
Merge pull request #109 from alphagov/move-authorisation-out-of-application-controller

move authorisation out of ApplicationController