Fixed #140. Fixed #142. See #146. Added basic permission check to scans.

In order to allow the backend to verify permission, a user query string is appended. This query string is '?email=<email-address>'. The check is performed by finding {'user': email, 'site': url} in the groups collections. Currently, issue #147 is reported but given our model, #147 is not a security issue. Therefore, by knowing a user (his/her Persona account) belongs to at least one group that contains the target url is sufficent enough to say the user has permission to view the scan or do work on the scan.
Allow admins to see all scan results; improved permission in scans to decorator.

Since the utlimate admin has permission to look at the database record anyway, admins normally should have power to look at all results. This privacy changes might be revoked later if we introduce tigher auth control.
Make permission check optional for /scans* apis.

Once scans are created, we don't need to check permission anymore.
Add permission check to POST /scans.
Merge pull request #148 from yeukhon/ownership-issues

Add user authorization checks to /scans*