Added named routes; made use of permissionTo filters.

- All routes now must be named routes. Existing ones were adapted.
- Routes for user creation (user.create and user.store) now run on
canCreateUser filters.
- User create form page is now in place (nice thing the style for simple
forms worked for it).
- List of all users isn't supposed to have a create user form anymore.