Add requirePermission middleware for authorization

This middleware checks if the authenticated user has permission to
perform a given action.

I've also updated any places that were using requireUser to use the new
middleware. The requireUser middleware has also been kept but that only
checks for an authenticated user, it doesn't tell you whether they've
got permission to edit an instance.
Require the user to be logged in before creating an instance
Add grantPermission method to Permission model

This reduces repetition when granting a user access to an instance.
Simplify new instance creation process

Previously the user had to enter a slug and email address, then they'd
receive an email with a confirmation link, which would lead to a page
with another button that they needed to click before their instance was
finally created. This has now been replaced with a form with a slug
field, which once completed takes the user directly to their new
instance.