user permissions as route decorators

Routes can be decorated with @auth.permission_required(perm)
which only grants access to the route if the user has the
necessary permissions or is an admin.
The special permissions are saved in the User object's
permission field as repeated StringProperty.
All used permissions are collected magically "as you decorate"
views and shown in the UserUpdate admin interface as multi
checkbox to pick from.
The UserX model is extended for a has_permission() method for
easier checking in templates.