Decouple screen authentication from user screen permissions

Addresses issues raised in #958. The act of displaying a screen is
now its own "action" in the Ability class, distinct from being able
to view its data in the panel. To facilitate this, when a client
acesses the frontend for an unsecured screen (or one with MAC
address identification), it now appears as though the client is
authenticated as that screen.

Further, a "preview" permission is provided for logged-in screen
owners for accessing a frontend preview through the admin panel.

Hopefully someone else can test this out before we merge but I'm thinking most use cases should be covered.