Signed-off-by: NDmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

* dont allow protect/unprotect branches for users without master permissions
* dont allow access to Repository api for guests

Also, is_admin and can_create_group are exposed in the user information.
Fixed attributes_for_keys to process properly keys with boolean values (since false.present? is false).

Change-Id: I305266fe9acbbb5136adeeb52e7e4e1d6629a30a

-Specifying a header of SUDO or adding a :sudo with either user id, or username of the user will set the current_user to be that user if your identifying private_token/PRIVATE_TOKEN is an administrator token

Added ability to add and remove the forked from/to relatioinship
between existing repos.

Added a helper method to check if required parameters are given in an API call. Can be used
to return a `400 Bad Request` return code if a required attribute is missing.
Code clean up and fixed tests.

Extracted a method for 400 error (Bad request) and adjusted code accordingly. The name of
the missing attribute is used to show which one was missing from the request. It is used to
give an appropriate message in the json response.