Fixes#4861
Since the around_action is defined before authorize_resource is called,
the handler needs to pass on the CanCan::AccessDenied exception.
I've added the timeouts where I think they were missing (e.g. UserPreferencesController)
but I've kept the exception for changeset#upload and traces#create
Now that we have all api controllers inheriting from a common base,
it's easier to override the deny_access handler without having to
switch between both.
Fixes#2064
