CLC-3414 "Implement: Re-authenticate when accessing View As"

https://jira.ets.berkeley.edu/jira/browse/CLC-3414

created a before filter in the application controller (:check_reauthentication)

that checks that the authenticated user is an admin and in the case
that they haven't reautenticated yet, and the renew=true param is present,
reauthentication is performed by calling /auth/cas?renew=true

Had to do a monkey patch on the omniauth-cas gem for the login_url method:
It checks that if the renew=ture parameter exists, and if not, it merges the
renew=true parameter into it's login_options that end up building the CAS url.

Upon callback from CAS, the SessionController#lookup method sets the :reauthenticated
cookie if the user is acting_as and the renew parameter is present.

This functionality has been implemented with the Settings.features.reauthentication flag

Fixes made to this PR
- Removed any special redirects from the UI. The check_reauthentication skip_before_filter
- skip :check_authentication filter in :lookup, :stop_act_as, and :destroy actions of the SessionsController
- feature flag was wrongly named: reauthorization instead of reauthentication
- Made previously passing tests pass again by sticking
  Settings.features.reauthentication = false
  in the before block.
- added bootstrap controller test that proves that admin users who are acting-as and have no reauthenticated cookie get redirected to /auth/cas?renew=true
- Stub out Settings.features.reauthentication = true, so that the existing act_as_user_spec tests pass
Merge pull request #2400 from chikoon/CLC-3414-reauth-on-view-as

CLC-3414 Re-authenticate when accessing View As