Permissions UI

Among other things, fixes #482 and #450.
Then I would suggest that you do something like:

```
return unless Session.get 'currentPublicationId'

return unless Publication.documents.findOne Session.get 'currentPublicationId'
```

It is clearer what you want to do: require publication to exist on the client.