Rename check_authorization.

Rename SecuredController's check_authorization to check_authorization_header so it doesn't cause any reading confusion with CanCan's check_authorization.
Change CanCan AccessDenied testing.

Handle CanCan::AccessDenied via ApplicationController rescue, returning 403 with insufficient_scope error. In tests, look for the forbidden response instead of checking for an exception (makes the tests look nicer too).