Upgrade to OmniAuth CAS 3.x

[awilfox]

• Display button on UnauthorizedError instead of redirecting to login.

• Use ForbiddenError instead of redirecting to login when a user that is not an admin tries to access an admin page in the section for ref cards/stack passes.

• Update specs.

---

Potential TODOs:

• How do we want the button to look? Right now it's a plain button, and could probably use a bit of style.
• Is my change of using Forbidden when a non-admin user tries to access admin pages for the ref card/stack pass the correct way to go? It feels weird to ask them to log in again when they're already logged in, just not as an admin user. (Is this for shared computers, perhaps? That would … almost make sense.)

[awilfox]

Example of what the login button looks like right now:

[davezuckerman]

Looks good to me as far as the code goes. As for the questions.

I think the current button looks fine (maybe a bit boring) but I don't have a great artistic eye for that kind of stuff.

For the question about a user being logged in but not being an admin. It seems correct to raise the forbidden error. Even if it's a shared computer they should still be logging in as themself right?

[yzhoubk]

It looks good on my local and the workflow makes sense. Admin page looks solid, would be nice to get Jesse's thoughts too.