Handle @restrict_access exceptions at the methods

This mean it is possible to read the decorator arguments and
know the full access restriction. Remembering what methods
are exceptions will no longer be neccesary.
Refactor restrict_access for briefness & clarity
Use response.ok over testing for 200 status code

One line instead of two and it's one less magic number.
Add restrict_access info to docstrings
Embed captcha text with _embed_text

This mean the text will now be above the parameters.
The also fixes the bug where all lines, save the first and
those about the captcha got indented an extra 4 spaces.