First stab at permissions.

Building the permissions and using them, plus associated tests.
Extending test coverage for user_can()

Now includes partial packages and rebuilding permissions.
Refactored to have a UserRepresentation interface

This will be useful when we need to force user logins and such, and
means that Auth can tell some information about the current user
without relying on the session.
Aded force_login to auth.
Added tests for the can() shortcut
Basic overriding of permissions is done

Needs more tests and rethink how loading user reps is done.