🧹🔐 Room: Don't always provide a current_room

[zspencer]

• 🔐🤔ApplicationController makes authorize calls -- should they be policy-scoped calls instead? #926
• ⛰️✨ Sections #1155

There are many pages that are not in a room, and the policy_scope of current_room could result in a false safety.

That said, we probably should also be writing request specs to confirm that folks get 404 on endpoints outside of their scope...

[zspencer]

I think this is a mite dangerous, in particular because we do have the idea of an entrance, so I think it's probably best if we don't apply this change.

[anaulin]

Yeah, I don't think it is worth removing current_room. The policy_scope here feels fine, and it feels right to have a current_room at the ApplicationController level. I say let's drop this for now. (We can always revisit if we run into issues again.)