Unify lockout and improve middleware

This PR does two things:

1.  It pushes the middleware declarations from the routes file into the respective controller files
2.  This PR removes `lockout.ensureAllowed` in favor of the middleware based approach.