Permissions should support a way to say "all authorized humans"

This could be useful for Persona Auth and LDAP auth (token auth shouldn't use it)

Basically a way to say "somepermission" is good for any logged in people.

I'm thinking '`__all__`'

Part of the reasoning is so that we can give explicit perms for things to tokenauth users, rather than 'all'