Show workspecs to everyone

Everyone sees all work specifications now. On row level, the option to edit/delete is only enabled if current user created it (or is admin/staff).

Disabled on row level:

Disables on detail view:

Implementation notes:

• In domain driven fashion, the actual logic for determining whether a user can perform an action (edit, delete, submit) lives in the model
• Right now, the check for view and submit always yields true. This fine-grained control over the actions (view, edit/delete, submit) allows for easy future changes if needed (and was easy to add)
• Rendering in templates uses template tags (which in turn call the model functions)
• Access to the actual endpoints uses mixins (which in turn call the model functions)
• Rest API endpoints for submitting/deleting use the model functions now
• Authentication was added to workspecification endpoints