Update authorization.rb

original_fullpath works better than fullpath here, because fullpath doesn't play nice with mounted engines.

For example, with rails_admin, request.fullpath is "/admin/" but request.original_fullpath is "/admin".