Block REST _all_docs from returning docs user doesn't have access to

Includes some unit tests for document access control.
Fixes #17.