Add requireAdmin() method to Controller.

 * requireAdmin() is like requireLogin(), but requires
	the current user is an admin.
 * userIsForbidden() method is also added and returns
	a 403 error to the user.
Add minimial initial UserManagement stuff.