Update authorization on products.

This uses the same authorization logic from #63 and fixes #26.

Anonymous users can:
- See a list of products.
- Search for products.
- View a specific product.

Regular users can:
- Do the same as anonymous users, and
- Download products.
- Add products to cart.

Admin users can:
- Do the same as anonymous and regulars users, and
- Create products.
- Edit products.
- Delete products.

CC: @mex