Fixes#4861
Since the around_action is defined before authorize_resource is called,
the handler needs to pass on the CanCan::AccessDenied exception.
I've added the timeouts where I think they were missing (e.g. UserPreferencesController)
but I've kept the exception for changeset#upload and traces#create
This will eventually replace the unversioned 'capabilities' call.
Client applications can use this versions call to find out what versions
are available, if they support multiple versions. The capabilities
of each version, and the format of the capabilities call, is then
able to change between versions. If a client only supports one version
they can jump straight to the versioned capabilities call.
Additionally, supported versions are now a list of version identifiers,
without any implications surrounding min/max values (e.g. guesswork
for supported intermediate versions).
Fixes#2162
