Add access limit fields/validation to Asset.
Whitespace.
Add prereqs to README.
Add access limiting to media controller.

Currently relies on the host containing the word
'private' to indicate we're on the private vhost.

This may be kept or may be replaced by an HTTP
header.
Bump GDS-SSO to 9.1.2

Needed for:
- Inclusion of organsiation_id in the user object
- Fix to `current_user` methods when not logged in
More explanatory name to indicate a private request.
404 unauth'd requests on both public & private interface.
Move back to forcing signin by default.

`require_signin_permission!` implies `authenticate_user!`
Check host from an env var instead of hard coded.
Merge pull request #23 from alphagov/add-access-limiting

Add access limiting