Sticky privacy on the browser

- The permission plugin no longer sets the permissions
- Read permission is a one-item list ["group:__world__"] instead of ["group:__world__", <username>"]
- Privacy directive moved to directives/privacy.coffee
- Uses the simple localStorage solution inside the privacy directive.