[#943] Tweak a TODO in the docs
[#943] Prepopulate context in check_access()

In some cases authorization functions can get called without the basics
(model, session, user) in their context dict. For example this was
happening to the group_create() auth function in the
example_iauthfunctions plugin, but only when it was called via the
templates not via the API.

This commit just changes check_access() to always put model, session and
user into the context if they aren't there already before passing the
context onto an auth function.

get_action() was already doing this for action functions.