Cleaner permission initialisation

Previously, permissions were only assigned to the corresponding default
groups on initial installation, but not if they are introduced later.

This commit introduces the configuration option
adhocracy.autoassign_permissions, which automatically assigns newly
introduced permissions to the default groups. This option is enabled by
default and should be turned off in restrictive environments.
Improve authorisation checks

This commit does a couple of things:

- Make sure that all controllers are protected with authorisation
checks. This allows to configure environments that also restrict read
access (fixes #366).

- Controller method which aren't meant to be exposed to a URL now start
with an underscore.

- Use guard decorator instead of require (where possible).

- Introduce a couple of new permissions (fixes #159 btw):
  * abuse.report
  * badge.index
  * event.index_all
  * static.show
  * user.index_all