Require permission to see views

This fixes a bunch of things:

* adds a 403 template
* requires the analytics.can_view_dashboard permission to see the
  analytics_dashboard and spam_dashboard views
* switches to using "first_name" everywhere we greet someone
* fixes the dashboard link so that /, /dashboard and /dashboard/
  all work and go to the same place