Make anonymous user distinguishable from Django's AnonymousUser

Django uses a special object---the AnonymousUser---for requests that are not
bound to a logged in user. Since we use guardian we replace this object with an
actual user object (with the ID set in ANONYMOUS_USER_ID, usually -1) in a
middleware class. So far this user had its is_anonymous() function set to return
False. This however imposes a problem if one wants to have permissions for this
users (e.g. testing them with user.has_perm()). As it turns out, permissions are
not checked if is_anonymous() returns True. The Django documentation says this
method is only used to distinguish real user objects from the AnonymousUser
object. Our anonymous user is a real user and therefore this commit changes this
function of the anonymous user to return False.
Allow user list retrival also for not logged in users with can_browse permission

This allows also for setups where the anonymous user (i.e. not logged in user)
can access this information if it was given the can_browse permission.
Fix whitespace in some files [minor]
Permissions: use permission names that are not duplicates for data view
Annotations: require can_annotate permission for removal