apiserver: allow AllWatcher access even without controller login access

[rogpeppe]

A watcher is special in that it can't do anything unless a resource
has already been created (with a Watch method). That means
that the important place to check permissions is when the
watcher resource is created, not when the watcher is used.

The permission check removed here was both unnecesssary
(as described above) and insufficient (the user might have login
access to the controller but no access to the model being watched,
for example).

[mhilton]

👍

[frankban]

Looks good and solves a GUI issue we are seeing.

[rogpeppe]

!!build!!

[rogpeppe]

$$merge$$

[jujubot]

Status: merge request accepted. Url: http://juju-ci.vapour.ws:8080/job/github-merge-juju