Refactor ownersip / authorization

[itsrachelfish]

There's some boilerplate I've noticed in controllers that should be refactored. Many controllers need to determine if the current user is the creator of a model object or has permission to view / edit it. This logic could probably be handled by a custom middleware with a couple parameters.

// Did the current user create this application?
if($application->user->id != Auth::user()->id)
{
    $request->session()->flash('error', 'Only the person who created an application may change it.');
    return redirect('/login');
}

[itsrachelfish]

Another example which appears in the ApplicationController and AnswerController:

if($application->status != 'new')
{
    $request->session()->flash('error', 'Your application has been submitted, you may no longer make changes.');
    return redirect('/applications/' . $application->id . '/review');
}