I disagree about handling authorization in the controller. I handle all my authorization in my model; typically I handle it in the database. If they aren't authorized, it looks just like it doesn't exist in the database.
As for dependency injection, it does make testing much easier. I wouldn't say never create an object in another object, after all some languages only have objects. Like everything, its a trade-off, so I think its more important that you consider your situation and what will serve you best in that instance.
If they're objects who classes you are responsible for and thus you need to test independently, then dependency injection can help. It also can help if you think you might change implementations; perhaps if you are running an e-commerce site and you switch from PayPal to Authorize.net