Restrict who can update or delete characters.

If a user owns a characer, or if a user owns a campaign to which that character
belongs, the user can do the following:
* update the character
* delete the character
* fetch the character update form
* fetch the character delete form

If a user is denied while fetching an update or delete form, an HTTP 403
response is returned. However, no nice HTML response is returned. Additionally,
no unit tests have been written for the functionality added in this commit.
Add doctest for method views._user_owns_character

The doctest passes! Five other unit tests fail, though. :(
Add unit tests for Character authorizations

Add unit tests for the following requirement: a user must own (directly or
indirectly) a character to update or delete that character, or to fetch the
update or delete form for that character.
Add nice error messages when issuing HTTP 403

An HTTP 403 response is generated if a user does not own character N, and if
they fetch either of the following URLs:

* character/N/update-form/
* character/N/delete-form/

This commit ensures that a human-readable explanation is returned along with the
error code.