Access rights silhouette

[johannsell]

Precondition: Drops #267

The system has to use the list of AccessRight associated with a user to filter the access of an action. To do so, a new filter has to be implemented in app/utils/authorization/. This filter has to compare the given Request object with the list of access rights. While the base implementation of the AccessRight contains a simple URI attribute that can be compared using string comparison, we also have to consider the changes made by implementation of #267. Now there are dynamic parameters at the connection between User and AccessRight.

After all, the filter has to be used at every action! The implementation is not done, until the system-wide usage of the filter is checked.