add explicit carrierwave ORM loading
Ensure users are logged in when accessing protected routes, and rescue from an authz failure gracefully; fixes #97