Allow permissions to be checked from Meteor publish functions.

Meteor.user() and Meteor.userId() can't be called from Meteor.publish
functions.  This commit adds an optional `userId` argument to `isAdmin`
and `hasPermission`, allowing permissions to be checked from publish
functions.