Fix unhandled errors on maybe_user_id unwraps in authorization logic

[mario-nt]

There are several unwraps that lack error handling in the authorization logic when unwrapping the maybe_user_id variable, this PR fix that by handling the errors.

[josecelano]

Hi @mario-nt, in all these cases, the feature requires an authenticated user. It would not be possible to allow guest users to perform those actions because it's hardcoded in the feature.

For example, the image proxy works with a user quota, therefore it would not work without a user.

Instead of panicking I would return an "unauthenticated" error, even before calling the authorization service.

And maybe we should even check for invalid permissions in the casbin policy. For example, these policies should not be allowed:

guest, GetImageByUrl
guest, AddTorrent
guest, ChangePassword

In order to allow them in the future the app behaviour must be changed. For the ChangePassword action it does not make sense at all to include it in the policies unless we want to allow in the the future the "admin" to change other users' passwords, which is something I wouldn't do.

[mario-nt]

@josecelano Maybe we can still use the user_id extractor in the handler or move that logic to the service:

Also we need to find a way to not allow those policies as they break the expected behavior of the app and might even lead to a security risk.

Actually, right now, the authorization policy is coupled with the logic in the handlers and services, maybe we should not allow end user to modify Casbin policies directly, only certain things like users and roles, and then persist those settings into the Casbin policy. All those customization options should be constrained and decided before hand.

[josecelano]

ACK 2e4b8d6