Pundit authorisation added to app.

Closes #34. Closes #32. Closes #43.

Actions permissible only to Registered or Guest Users are protected from unauthorised access. This includes a suboptimal implementation of the SessionsController, as extraction of Pundit authorisation into DSOs is not presently cost-effective.