Add apps permissable checks in posts and users

Closes #2738

- Re-introduce the TargetModel.permissable interface check in the
regular permission flow path
- Pass loadedPermissions, hasUserPermission and hasAppPermission to
permissable interface to reduce logic necessary
- Refactor recursive call to pass original arguments but with actual
model
- Refactor canThis(this.user) use in api/posts.js to just canThis(this)
Merge pull request #2753 from jgable/fixPermissable

Add apps permissable checks in posts and users
Fix sign up not setting user on session

No issue found

- Grab user out of api response from users[0]
Merge pull request #2766 from jgable/fixRegister

Fix sign up not setting user on session
Refactor API arguments

closes #2610, refs #2697

- cleanup API index.js, and add docs
- all API methods take consistent arguments: object & options
- browse, read, destroy take options, edit and add take object and options
- the context is passed as part of options, meaning no more .call
  everywhere
- destroy expects an object, rather than an id all the way down to the model layer
- route params such as :id, :slug, and :key are passed as an option & used
  to perform reads, updates and deletes where possible - settings / themes
  may need work here still
- HTTP posts api can find a post by slug
- Add API utils for checkData
Merge pull request #2732 from ErisDS/issue-2610

Cleanup & Refactor API option names
Move debug page from /settings/debug to /debug

closes #2743
- remove settings/debug route and associated files
- reimplementation at debug route