Secure group edit with new decorators

This is a large refactor that allows for chainable decorators that decorate the ``request`` with a group object and enforce editability constraints base on the logged in user.

The ``group_request`` decorator takes it's cues from the auth context processor. Views wrapped with this decorator will have a ``request.group`` in addition to ``request.user``. This makes for easier composability of decorators and has the side effect of ensuring that the group is only queried once.

I renamed the existing decorators to make them more forceful. For example ``is_census_admin`` is now ``user_must_be_census_admin`` which is more suggestive of the fact that a view wrapped with this decorator will return 403 Forbidden if the ``request.user`` is not an admin.

While working on the decorators, I also clarified the two different types of training, which grant different levels of page access.
```python
from functools import compose
from operator import attrgetter

def boolean_gate(predicate):
    def decorator(view_fn):
        @wraps(view_fn)
        def wrapper(request, *args, **kwargs):
            if predicate(request):
                return view_fn(request, *args, **kwargs)
            else:
                raise PermissionDenied
        return wrapper
    return decorator

user_must_be_census_admin = boolean_gate(compose(user_is_census_admin, attrgetter('user'))
user_must_be_group_admin = boolean_gate(lambda request: user_is_group_admin(request.user, request.group))
```