Really restrict viewing of the leaderboard to only GDS Editors

- Currently, anyone with any permissions guessing the `/leaderboard`
  route can view the leaderboard as the GDS editor permission check only
  hides the menu option. Hide the page as a whole for those people not
  GDS Editors.
Merge pull request #391 from alphagov/restrict_leaderboard_to_gds_editors

Really restrict viewing of the leaderboard to only GDS Editors
Move Bulk Add into a separate controller

First step in cleaning this code up.
Simplify BulkAddBatchesController#create_multiple

Now that we have a dedicated controller, we can make this route a member route
instead of having it as a collection route and faking the member-ness.
BulkAddBatchesController#new_multiple => #new

This makes it more Rails-y and more consistent wth ImportBatchesController.
BulkAddBatchesController#create_multiple => #import

"create_multiple" no longer makes sense. The resource this controller manages
has already been created. The natural thing to call this method is "process"
but that can't be used because Rails uses it internally.
BulkAddBatchesController#new_multiple_confirmation

Rename this to be more Rails-y. This method creates the resource this controller
manages, so create is the right route to use.
Add BulkAddBatchesController#preview

No one likes rendering a page on POST. Redirecting to a URL is nicer because:
* you can reload
* you can navigate forward and back to the page without being prompted to
  resubmit the form

It also brings us into line with ImportBatchesController.
Make before_filters simpler and more consistent

Make it more like ImportBatchesController.
Shorten strong params filtering method

Also makes it consistent with ImportBatchesController.
Whitespace
Remove some unreachable code

`update_attributes!` on the preceding line would raise an error if there were
any validation errors.
Simplify BulkAddBatchesController#import

Also makes it consistent with ImportBatchesController.
Merge pull request #388 from alphagov/move_bulk_add_to_separate_controller

Move bulk add to separate controller
Fix hits pagination links

I think these have been broken since we upgraded to Rails 4.x and the way that
these routes were implemented was no longer supported.

This way is less code, less metaprogramming and easier to follow.
Merge pull request #393 from alphagov/fix_hits_pagination

Fix hits pagination links