Use a before_filter to find the Application in ApplicationsController

This makes overriding the default authorization much less code.
If you agree, I'll add a test.