DRY up permissions code: move out of individual methods and into function call.  rules.server.js now defines administrator definible options (may move into db record for remote admin access later). Remove bug that allowed null user to upvote.