Simplify privileges

uses a central `has_privilege` function instead of similar try/except workflows everywhere.

depends on https://github.com/dimagi/django-prbac/pull/9
F401 'ensure_request_has_privilege' imported but unused