Start using the `signed_in` decorator

- get the client returned from the decorator, which now has permissions assigned to it
- pulls out quite a bit of setup code an is *hopefully* more readable
Change form redirect test to check location of redirect

- Cuts out the inspection of 'pending_dashboard' in the client session (as this was being included but not actually tested in the test)
- Checks that if your permissions are right you get redirected to the administer page, and that's it.