Use RecordNotFound instead of CanCan::AccessDenied, since it renders a 404
Add Concord Portal single-sign-on support

[#72365976]