Switch some routes to app.locals.hasPermission

We will use this from now on instead of the user object's hasPermission.
This lets us use roles to assign permissions to all visitors and all
regular users. It will check the current user's permissions if it needs
to.