First pass at access control

Starting with an admin user and group and doing ACL checks on repository creation.
Moved AccessDeniedException into common (since it's used by the backend and jsonmodel_client).  Throw it as required.
Fix integration tests by logging in as the admin user
Tweak permission checking: don't special case the admin group.

Instead, automatically grant permissions to admin.
Added model method for querying a user's list of permissions (derived from their groups)
Added endpoints for querying all permissions of a single user.
Hide certain UI functionality (repository creation, group management) based on permissions
Limit group listings to the current repository
Add and endpoint that shows all repository-level permissions.

The frontend now uses this to display the list of available permissions when managing groups.
When creating a repository, automatically add a repository-managers group.
Added support for webhooks, allowing the backend to push messages to the frontend.

To keep the UI snappy, we minimise the number of backend requests made for
each frontend request.  Some bits of information from the backend are used in
almost every page.  Currently:

  * The list of repositories

  * Subject term vocabularies

  * The list of permissions assigned to the current user

To avoid having to refetch these lists on every request, we want to allow the
frontend to cache them.  Then the usual problems of cache invalidation pop up:
we need some way for the backend to signal to the frontend when its data has
changed.

This is what we use webhooks for: the backend knows the URL of the frontend,
and registers it to receive notifications for certain events.  When backend
code calls Webhooks.notify, the backend sends a POST request to a controller on
the frontend with one or more events.  The frontend can then invalidate its
caches in response to this.

So, summarising the changes, on the backend we have:

  * A new endpoint that API clients can use to register their webhook URLs

  * A new database table for storing the list of webhook URLs

  * A new Webhooks class that allows you to broadcast an event (with
    very rudimentary support for deduplication of events and queueing)

  * Notifications fired in response to the backend starting up, groups being
    changed, repositories being added.

And on the frontend:

  * A new controller for receiving webhook notifications

  * A MemoryLeak class (heh) that provides shared memory for all threads.
    Allows getting and storing cached values in a thread-safe way.  Also
    provides support for time-based cache expiration.

  * New handlers for webhook notifications that invalidate the caches as
    appropriate.
Speed up backend tests a little by creating repo via the model instead of the controller
Disable JRuby JIT to speed up tests a bit
Added checks to ensure that global permissions can't be assigned to repositories
Create a repository-users group when a new repo is created
Switch a couple of stray uses of "repo_id" to use the standard definition for that parameter.
Add a new 'view repository' permission and check for it whenever accessing a repository.
Remove all unrecognised parameters during endpoint param handling.
New access restrictions:

  * To GET against a repository endpoint (/repositories/*) you need 'view_repository' permission.

  * To POST to a repository endpoint, you need 'update_repository' permission.
UI tweak to show something when the user has no repositories.

We can think of how best to convey this later.