introduces policies

The pattern used here is taken from pundit although this here does by
far not have the functionality pundit offers.
fixes permission links on query
to menu option only on page with menu
reuse query link allowance evaluation
protects agains query manipulation via API
expect policy to be called in controller
Merge pull request #1979 from opf/fix/query_permissions