Permissions UI

Among other things, fixes #482 and #450.
No no. This is not right! :-) In this case `forEach` is [Meteor API](http://docs.meteor.com/#foreach). Cursor is not an array! You cannot use CoffeeScript here. You could do `for publication in Publication.documents.find(...).fetch()`, but that would be copying everything in memory and then iterating. So cursor's `forEach` is better here.