Make permissions / authorizations pluggable

In my project, I have requirement to create private forums, based on some application specific logic (basically, I need a private forum for every instance of my app's object, and control that only users belonging to that object may read or write to that forum).

Since I assume others may have similar requirements (but of course different application logic), I made this patch which factors out all authorization to a permission handler class, which can be overriden through settings. 

This logic would also (somewhat) address elDante's [pull request](https://github.com/hovel/pybbm/pull/41) - he could implement his changes simply as a new permission handler, without breaking the sites of users who rely on the old logic.

My patch should pass all unittests by now, please drop me a note if you find something broken.