Secured the api and restructured the angular ctrls

Many changes made

The api has been secured by using slc loopback:acl and setting the
proper permissions for a user to create, modify or delete their own posts and
comments while preventing them from modifying anyone else's posts or
comments. The ui does not yet fully reflect this change, but that's
coming next.

The angular controllers were restructured to run the necessary methods
through the User model so as to ensure the correct permissions are
applied.