Add access limiting to media controller.

Currently relies on the host containing the word
'private' to indicate we're on the private vhost.

This may be kept or may be replaced by an HTTP
header.
Bump GDS-SSO to 9.1.2

Needed for:
- Inclusion of organsiation_id in the user object
- Fix to `current_user` methods when not logged in