Remove unused agent controller
Define permissions for all endpoints (previously marked as .nopermissionsyet)

Get around the thorny issue of who should be able to update/delete subjects,
agents and vocabularies with the following rules:

  * You can update agents/subjects/vocabularies if you're granted access to
    update archival records in any repository.

  * You can delete agents/subjects/vocabularies if you're granted access to
    delete archival records in any repository.
Refactor search to avoid the need for a single global endpoint.

Instead use type-specific endpoints with more fine-grained permissions.