decoration time order checking for auth decorators like admin_required

If you sloppily added an `@auth.admin_required` decorator above the
`@app.route(...)` lines you would notice that the permission is not
checked.

The reason for this is that the `@app.route(...)` decorator registers
the view function as is "from bottom up to the route decorator and not
further" in `app.view_functions`.

This commit introduces checks which are performed once at decoration
time to check if the passed in function is already part of the
`app.view_functions` and the permission logic would be skipped.
If this is the case a SyntaxError is raised notifying the developer.
refactor decorator order guard code into helper
Merge pull request #149 from joernhees/security_check_auth_decorator_order

decoration time order checking for auth decorators like admin_required