Move auth logic to application controller

Instead of repeating over and over again the same logic, better move it to a centralized place. You can then leverage `skip_before_filter` to choose which controllers and actions need authentication and which parts don't.