Image model is Authorizable
Make roles and filter management delegatable

We have now permissions for Filter and Roles management. By default no
role contains them so only administrator is able to manage it. Filters
support granularity.