Retrofit authorize with tests, tests also require user set whatever

This will allow us to use the permissions array in other places to
determine the access a user has
Tests pass - the user is always set in the session

they must also have access to be signed in.
Test for new app root behaviour
Test if user has access and redirect accordingly

If this can't yet be determined, redirect to login.
Includes template for new app root - you can't sign in.
Tests pass