add #secure_category? method to topic class
more refactoring

Fix bug that prevented flagging of archived topics
Rename NullUser to GuestUser
remove #have_both? in favor of #authenticated?
DRY up can_<action>? methods