Added authorization to the Cars controller.
Needs work: the maintenance and refuel controllers need to be further restricted against invalid access to other users' cars.
            A user can change the address bar from /cars/[:id]/maintenances to /cars/[:other_users_car_id]/maintenances and create a maintenance entry that shouldn't be there.
            This leaks data, and I don't like it.

Signed-off-by: Michael Englehorn <michael@K0HAX-DT-Debian.englehorn.local>