Enforce auth.user permissions

[2ynn]

I suggest:

• keeping is_staff for pick_leaders
• adding a core auth.user group for core-members w/ limited permissions (in progress)
• reserving is_superuser for developers/admins

[2ynn]

at the moment a superuser is automatically considered as a core member:

    def is_core(self):
        ''' check if user is a core member or superuser'''
        belongs = self.groups.filter(name="core").exists()
        return self.is_superuser or belongs

This way only one tag is necessary in html : {% if request.user.is_core %}

EDIT: 487c401

• removed superusers from is_core(), will be more specific with permission tags instead, e.g.:
  {% if perms.member.change_person %} for better control over permissions.
• see commit 8b926b0 for example

[2ynn]

So far the distinction between using is_staff and the use of harvests_as_pickleaders (see CommunitySerializer) in attributing the Person's role in the community view is still blurry.

Note that is_staff is required to select a pick-leader in HarvestForm (see PickLeaderAutocomplete)

We could discuss the advantages of adding a pickleader auth.group. As it is now a logged-in user that is not core should, a priori, be a pickleader. Although this could change in a future, say if owners get to login with one-time passwords, etc...

[2ynn]

doc/permissions.pdf was approved by core

[tristanlatr]

In my opinion, pick leader should not be able to review the community page neither the statistic page.