introduce the concept of permissions

if a user isn't permitted to create a request, they don't
see the request in the navigation list
at this point, everyone is still able to create any request
change user stubbing in integration tests

use a hand-rolled stub instead of a mocha stub
prevent user w/o permission from creating requests
add content requester permission
add campaign requester permission
add 'single point of contact' permission