TC: factored 'access' logic into its own class

Access logic (read/write for templates) is now delegated into its own
class, RapidApp::Template::Access that can be either configured via
params or extended into a new class for full control of
access/authorization rules for templates
TC: misc API cleanup (permissions checks)