prevent non admin from changing page access
use login_required in People::FriendRequestController
fixup: guard expects method symbols
fix error when visiting page anonymously
No error for comment without edit access - fixes #8410

We always allowed comments if one can see the page. However a comment now also updated the page. This way the stats will increase and the page will be raised on peoples dashboards. If a user updated the page they will get a participation record for that page. Currently this grants read access independendly of the original access.

So if a page is public and i post a comment and someone turns the page non-public I will still have access to it due to my participation. A page admin can explicitly remove that access though.

I think this is the most consistent way in dealing with this. We already had the same situation if a group granted me write access, I commented and then access was revoked.
Merge pull request #104 from azul/bugfix/security-tweaks

Bugfix/security tweaks