Tighten down security settings

If we allow create_unowned_dataset, we also allow users to add resources
to all unowned datasets, and thats kinda bad.
Rework how user for cronjobs is created

Now with the organization based auth, we can't setup rights from the
cmdline anymore, so we just "reuse" any old cronuser, and thus its
rights.

This creates some manual work if you setup from scratch or upgrade from
a pre-organization CKAN to a post-organization ckan, but it works as it
should<tm> in the case of a restore from backup.
Download CKAN over git:// instead.

Due to transient problems with github, download over git protocol
instead, its a bit more effective to.