Fix acl_from_settings so it actually works.
Only test traverse permission on ancestors of context.
Configure permisssions so that only Authenticated users are able to view all but the front page. The development.ini and test setup still allows Everyone to view for now.