Making all actions inaccessible by default.

The previous behavior was that each action by default required
administration privileges. However, this made some controllers difficult
to read, as authorization was implicitly defined elsewhere.

Instead of explicitly adding redundant rules for readability, we're
changing the behavior to make each action inaccessible by default,
requiring developers to define authorization rules for each action.