more specific user permissions as route decorators

I frequently have the problem of wanting more fine granular control over who can access what than just the three groups admin, registered user or unregistered. 

With this first and very simple version i introduce an auth decorator:
Routes can be decorated with @auth.permission_required(perm) which only grants access to the route if the user has the necessary permissions or is an admin. In case no "perm" string is specified the route's function name will be the default for the permission.
The special permissions are saved in the User datastore object's permission field as repeated StringProperty.

I also introduced a util FormField: StringListField, which is quite useful in general.