blocks can accept extra data to be visible to blocks.html, and the /new route passes its template user and permissions. This is enough to get us to the point where we can address permissions in blocks for weathervane. TODO: think hard about running page loaders properly for new blocks, making extras visible to the page visible to the new block, making req a more universal part of what is passed to "self.render", etc.