better access control for search

For each of the packages check if user has access to it and remove
package info from the result if he doesn't.

ref #65

lib/index.js

@@ -171,10 +171,14 @@ module.exports = function(config_hash) {
 	})
 
 	// searching packages
-	app.get('/-/all/:package?', can('access'), function(req, res, next) {
+	app.get('/-/all/:since?', function(req, res, next) {
 		storage.search(req.param.startkey || 0, {req: req}, function(err, result) {
 			if (err) return next(err)
-
+			for (var pkg in result) {
+				if (!config.allow_access(pkg, req.remoteUser)) {
+					delete result[pkg]
+				}
+			}
 			return res.send(result)
 		})
 	})