Refactor @restricted decorator to view predicate

Now we don't have to maintain two trees of services, all
services live in the same tree, but we can still implement restricted
versions of specific ones using the restricted view predicate. View
config mechanism will take care of routing the service to the right
bits of code

* Unified all /admin/* resources to /*, except /admin/security
* Renamed all references to admin routes and uris in docs, code and tests
* Added restricted='Manager' to all former @restricted decorated functions
Organize all restricted services to admin folder