Added pghero and authorization for its view

We cannot use helpers in initialisers, so only access from auth_by_session is supported.
Closes #176

Downside from using the gem is, that auth check needs to be done in routes (don't match the route unless authenticated) and thus we needed to add a initialiser to use cancan in routes...
Do things still work properly if these are not specified? Could/should we have an option to turn pghero off in site.yml? LGTM otherwise.