Decouple screen authentication from user screen permissions

Addresses issues raised in #958. The act of displaying a screen is
now its own "action" in the Ability class, disting from being able
to view its data in the panel. To facilitate this, when a client
acesses the frontend for an unsecured screen (or one with MAC
address identification), it now appears as though the client is
authenticated as that screen.

Further, a "preview" permission is provided for logged-in screen
owners for accessing a frontend preview through the admin panel.
Screens shouldn't make security promises they can't keep

Also prevents screen preview access denied from existing checks for
these conditions.
Tests: Nonpublic screens must be secure to validate
Merge pull request #1054 from concerto/scren_auth_redux

Decouple screen authentication from user screen permissions