Api access decorators

This changes the default api endpoint security to require admin access. Each handler should be decorated with @admin, @user, or @public to override the default (the default is the same as specifying @admin).

I have attempted to pick the right value for all of the endpoints, but it would be handy to have someone else review my choices.  I have removed some of the admin and user checks that would now be duplications of what the decorators do.  Some of the tests have changed, since the error messages are not necessarily the same.

This applies to issue #340.

<!---
@huboard:{"order":261.5625,"milestone_order":362,"custom_state":""}
-->

Let's change this to `_defaultAccess`, I don't think it should be part of the public API.