WIP: Test users controller v2

update AppController->isAuthorized() - Added optional parameter to force the deny on GET requests

similar to !274 (closed)

see implementation with testing !279 (merged)