Allow completely private instances, part 1

This is the start of all changes needed to support entirely private
instances, where all blogs are only visible to other authenticated users
on an instance (ref T576). It begins by changing how Handler methods check an
endpoint's permissions.

• Renames UserLevelLEVEL consts to UserLevelLEVELType
• Adds UserLevelLEVEL funcs with same names as previous consts. Each returns a UserLevel
• Adds a new UserLevelReader that restricts access based on app configuration. This is now used on collections and posts.
• Changes routing a bit so static files are always accessible