Require the latest Django 1.4.11 security release.

This fixes a number of security issues. Most importantly to us, a bug in
reverse() that could lead to importing unexpected modules, if the
attacker knows which modules are on the server.

See https://www.djangoproject.com/weblog/2014/apr/21/security/
Release Review Board 1.7.25.
Fix using the wrong directive in the 1.7.25 release notes.

This was using :cmd:, which should have been :command:.
Fix permission name for creating repositories.

The Repository API already had some plumbing to allow users with a given
permission to create repositories regardless of their admin/staff status, but
it was using the wrong permission name. Trivial change.

Testing done: Ran unit tests.

Fixes bug 3307.