Allow permissions to be checked from Meteor publish functions.

[awwx]

Meteor.user() and Meteor.userId() can't be called from Meteor.publish functions. This commit adds an optional userId argument to isAdmin and hasPermission, allowing permissions to be checked from publish functions.