Add Pundit policies for authorisation

https://github.com/elabs/pundit

This is a WIP to demo Pundit capabilities.
I've only done enough to make all tests pass.

There is a lot of functionality not covered
by tests, hence there are some pending tasks:

1. show / hide links to actions based on whether
the user can perform those.
2. refactor the UserPermissionsControllerMethods
to use `policy_scope` to fetch the correct list
of applications.
3. use `verify_authorized` to ensure that all
controller actions are authorized.
4. remove paths '/admin' and '/superadmin'.
5. write more tests.