Prototype MVC changes for current authorize design

cc @yishaigalatzer @rynowak @loudej @blowdart 

Here's my take on what MVC changes would look like with the proposed auth changes so far:
- Replaced Permission claim concept with 2 policies: CanViewPage and CanViewAnything
- There was on test checking that NullPolicy would succeed, I don't fully grok what that was testing since we repurposed the policy name, so I just skipped it for now (my instinct was to flip that test around to ensure that UnknownPolicy FAILS instead)

<b>Question:</b>
- Do we still want Authorize to support effectively what would be an auto policy where its asking for a specific claim in the attribute?  The design currently doesn't support that, but I don't think its that bad requiring all authorize checks to go through a policy configured in startup...