Move to use flask.g.fas_user instead of the hardcoded fake one
Some more authorization check
More unit-test related to the last change
Only admins can create collections, adjust unit-tests accordingly
Fix authorization check when retiring a package.