Replace repoze.what-pylons dependency with custom function (fixes #250)

Introduce a direct permission check `perm`, which can be used together
with `can`, `check` and `require`, e.g.

    require.perm('global.admin')

Additionally, introduce a `guard` decorator, which allows to execute a
function in advance of the decorated function, e.g.

    @guard(require.perm, 'global.admin')