Authorization logic moved from ApplianceCreator into cancan

Inside `Atmosphere::ApplianceCreator` logic responsible for create authorization occurs. It was moved into cancan ability. 

Fixes redmine 3207 issue.

/cc @nowakowski, @djchrap, @Nuanda - please take a look. Deployed into `dev` - please test.
Well, this is actually ok. I think there was a looong public discussion before introducing this... controversial language construction to specs ;).