Refactor identifying rooms

This introduces Rooms.search(), which is used whenever a command
wants a room, and allows a room to be identified by ID, title, or
alias.
Only allow certain commands in PM

This fixes the issue where arbitrary /data commands were allowed to be
sent by PM.