Prevent unauthorized access by using a base class

[SSPJ]

The current permission system is opt-in, which allows too much room for mistakes. Update the permission system to be opt-out.

One potential method is to make all views class-based and ensure they inherit from a common base class which has appropriate permission mixins. Other methods may exist as well. Django's own auth system may provide some inspiration.

This work may intersect with #543.