Page visibility and controller permission code cleanup

fixes 6760.

Some page controllers overwrote authorized? and returned false. However the application controllers authorized? method would raise if the action was not authorized. So just returning false had no impact.

Since they seemed to be the original cause and quite dangerous I also cleaned up some long running controller annoyances:

* require_login now ONLY requires login - no further authorization
* require_authorization does the authorization and raises permission denied if needed.
* authorized? will not raise anything - just return a boolean

I hope this reduces the confusion about the different parts some. There
are a number of controllers where we want to require either login or
authorization but not both.