Simplified auth plugin

Simplified version of #1763 

Introducing auth service.
- Stores persona.
- Handles building/destroying Permissions and Auth plugins (moved from AppController)
-Privacy directive uses it.
- Fix #1759 (The replies permissions were not filled, only the reading permissions
because privacy directive used to fill the rest. But a change made it not to touch the permissions of an annotation which has the permissions already set.)

Changing everything to `services/*.coffee`? Sure, that should be a separate PR if we want to do it at all.

But at the moment this PR adds the `services/` directory which wasn't here before, making the naming of services inconsistent. So I suggest you rename `services/auth.coffee` to `auth-service.coffee`.