Handle action security in one place

Move all filters and accessRules to the root controller. Override this behavior on
SiteController which handles the log in of users.

Previously, any page was just served to the visitors without any check of permissions.

Any page that needs different security can override `accessRules` appropriately.
Clean up.
No need to specify any specific parameters