Use View permission on viewlets

to avoid security failures into viewlet if anonymous try to display non public parts of site.

closes #23