Fixes #1596 by ensuring it only shows active members.

Currently removing a user from a group/org (marking membership as deleted)
then it still gets returned in dataset/new as a viable organisation/group to
choose when it isn't (as the user is not actually still a member).
[#2037] Make resource_create auth work against package_update

Right now it was deferring to package_create, which doesn't make much
sense. Basically if you can update this particular dataset, you should
be able to add a resource to it. Added auth tests.

Also fixed the authorization for resource views creation. This is being
fully tested on #1852
[#2037] Fix logger call to allow warning on tests
[#2037] PEP8
[#2037] Don't remove package_id before resource_create auth check

I didn't find any good reason as to why it was being done, and it
prevents `resource_create` auth to check authorization against the
dataset.

Added action tests
[#2048] Upgrade repoze.who to 2.0
Merge branch 'master' into 1596-dont-show-deleted-members
Merge branch '1596-dont-show-deleted-members'
Merge branch '2048-upgrade-repoze' of https://github.com/brew/ckan into brew-2048-upgrade-repoze
Merge branch 'brew-2048-upgrade-repoze'