Simplified auth plugin

Simplified version of #1763 

Introducing auth service.
- Stores persona.
- Handles building/destroying Permissions and Auth plugins (moved from AppController)
-Privacy directive uses it.
- Fix #1759 (The replies permissions were not filled, only the reading permissions
because privacy directive used to fill the rest. But a change made it not to touch the permissions of an annotation which has the permissions already set.)

I'd move this into the constructor so there's no ambiguity about ownership of this variable. It's an instance variable, not a class variable, so set it in the constructor.