adapt note/thread permissions for creation (bug 879545)

* Add creation tests.
* Revise `mkt.constants.comm`
* Fix docs
* Add CORSViewet