Pass through member in can* calls

Authenticate can return Member, false, or true. If false then access
denied for all calls; if Member then used instead of
Member::currentMember for can* calls so we can be a bit more stateless.