Add Devise for authentication, add ACLs

We'll assume that authentication is the responsibility of the
upstream app.  We'll require Devise to function upstream and use it
to verify authentication.

An ACL model (Acl) and controller exist to provide KriKri-specific
permissions management.

KriKri's application controller requires authentication for all
resources.

The KriKri User model extends the wrapper application's User model.

The ACL controller is still missing JSON representations (REST
endpoints) and won't be useful for a Javascript frontend.  It
relies on cookies for authentication, which is not ideal for
non-browser agents.