review authorization

[fisx]

we have at least one remaining issue:

https://github.com/liqd/aula/blob/ce2dbd74145807667f024325976ab3328be248cb/src/Frontend/Core.hs#L451

this page is used for both delegating on school level and on class level, and it grants access if the user can do either.

other related issues like that may be hiding in the code. we should spend some more time convincing ourselves that we've found them all.

[andorp]

Related to: https://github.com/liqd/aula/issues/805