Use the list of accounts on the token for authorization, not all those associated with the user

[kookster]

• Get the list of accounts the token is authorized for from the aur hash/list in the token
• Handle the different cases for how aur can express lists of accounts, I think the rack gem handles most of this: https://github.com/PRX/rack-prx_auth/blob/master/lib/rack/prx_auth/token_data.rb#L32
• Use this list of account ids (any role) instead of querying memberships to determine accounts to use in the authorization controller

[kookster]

I am behind on my other tix, so reassigning to @gcampo88

[gcampo88]

handled in #240