Fixes#4861
Since the around_action is defined before authorize_resource is called,
the handler needs to pass on the CanCan::AccessDenied exception.
I've added the timeouts where I think they were missing (e.g. UserPreferencesController)
but I've kept the exception for changeset#upload and traces#create
It's a convention in rails to name your mailers with a Mailer suffix, and is also common to name the class after the recipient (e.g. User, Admin). So UserMailer seems a reasonable choice.
Now that we have all api controllers inheriting from a common base,
it's easier to override the deny_access handler without having to
switch between both.
Fixes#2064
