Simplified auth plugin

Simplified version of #1763 

Introducing auth service.
- Stores persona.
- Handles building/destroying Permissions and Auth plugins (moved from AppController)
-Privacy directive uses it.
- Fix #1759 (The replies permissions were not filled, only the reading permissions
because privacy directive used to fill the rest. But a change made it not to touch the permissions of an annotation which has the permissions already set.)

Right now the server let's you leave out permissions, but that means anyone
can take the action.

Fine to change that but it seems separate from this PR.