Using self.model for authorizing in BaseController

[butschi]

If there is an empty list passed in as a subject for authorizing in BaseController#authorize, it will use the Model class that is included as a class attribute of the controller to authorize.

That is technically not needed, since the Guard will return "true" in authorization if it received an empty list. But having the real Model class can provide us with the possibilities of a finer granular control in defining permissions, on the other hand.

Should we stick with it?