Improve stub_authorization in controllers to fix the promotion admin spec

The promotions_controller_spec has been failing since it was merged [:bomb:](http://ci.spree.fm/viewLog.html?buildId=49898&buildTypeId=bt76&tab=buildChangesDiv).

The existing stub_authorization for controllers stubbed out `authorize!`, which allowed any action, but made .accessible_by return an empty result set. It now behaves similarly to feature tests and returns a custom ability with all (or custom) permissions.