do not allow upload when no firewall is configured unless explicitly enabled

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | yes
| BC breaks?    | only edge cases
| Deprecations? | no
| Tests pass?   | see travis
| Fixed tickets | -
| License       | MIT
| Doc PR        | TODO

The current code did allow not authenticated users to edit content, if there is no symfony firewall configured in the security configuration. This fix limits this behaviour to when the user explicitly enables anonymous editing.

* [x] Update the ImageController as well. That one extends the MediaBundle image controller, so we should coordinate with the media bundle. i first hope to get some feedback here, then i can do a PR on media bundle.

This depends on https://github.com/symfony-cmf/MediaBundle/pull/85 for the image upload to continue working. I upped the minimal media bundle requirement in composer.json suggest to 1.1.*

/cc @rmsint