A more sane approach to handling unauthenticated GET requests

I'm not sure why I had never considered using Flask's `g` object before, but
now that I have, the handling of unauthenticated `GET` requests has become
simpler and more reliable. Procedure:

  * If the request is a non-authenticated `GET`, auth function sets a flag
  * If the request is to a collection, set the lookup to only display public
    posts before a database call is made
  * After a database fetch occurs, if the request is *not* to a collection
    and the permissions of the item are not public, abort the request

In this commit I'm also using a flag to signal that an app post has been and
saving the bewit to the credentials post in `g`. Later, before the response
is about to be sent, the event hooks can inspect the flag and append the bewit
if necessary.

I've also fixed a bug where after-event hooks were never been raised for HTML
requests, incorrect headers were being sent for JSON and XML requests, and
mime-types weren't properly recorded in the macros template.
Permissions handling for attachments and versioned requests