router.js: all router-level access checks now wait for required subscriptions to be ready instead of hacking around

This is continuation of #222 based on the same principle.

In some places settings are not required at all, so `Session.get('settingsLoaded')` was removed. In the rest, it was added to subscription dependencies.