/gold/creditgild: Check comment viewing permissions.

Previously, it was possible to generate a payment blob for a comment the
user does not have permission to view (in a private subreddit or
deleted) and then use the creditgild form to see the author and content
of the comment.  This adds a check to creditgild to ensure correct
permissions at display time.

This fixes an information disclosure vulnerability reported by Jordan
Milne (/u/largenocream).
/api/generate_payment_blob: Check comment viewing permissions.

This is not strictly necessary as /gold/creditgild is where the
information leak actually occurs, but checking here should help prevent
future leaks of the same type.

This fixes an information disclosure vulnerability reported by Jordan
Milne (/u/largenocream).
/tb/: Check permissions before redirecting.

When the user is not logged in or has the toolbar disabled, the toolbar
endpoint will turn a link ID36 into a redirect to the submission on
reddit.  This redirect includes the slugified title of the post as well
as the subreddit it's in which could lead to a leak of information from
a private subreddit.

This fixes an information disclosure vulnerability reported by Jordan
Milne (/u/largenocream).