Authorize API::QuestionsController through `Survey`.
When authorising QuestionsController methods using the parent survey, use `try` in case it doesn't exist.
Authorize the API::CategoryController actions using the parent survey.
Don't authorise Surveys#questions_count.

It fetches counts only for authorised surveys anyway.
Authorize API::OptionsController using the parent survey.
Option#survey delegates to it's parent question.

Update the version of `shoulda-matchers` so we get the `delegate_method` matcher.
Finish up ViewerAbility.

- Add abilities to see responses/reports.
- Add abilities to see surveys shared with his organisation.
`current_ability` returns a PublicResponseAbility only if there isn't a logged in user.
Pass all the failing specs with the change in roles.

- Removed the old_ability file.
- Added a dummy (for now) AdminAbility class.