* dont allow protect/unprotect branches for users without master permissions
* dont allow access to Repository api for guests

Use "/commits/:sha/diff" as opposed to "/commit/:sha", keeping in line
with existing api urls (e.g. "/projects/:id", etc.)

Fix 500 error resulting from a diff api call with an invalid commit hash

Move "/commits/:sha/blob" to "/blobs/:sha", leaving the old path for
backwards compatibility.

Add ability to get a single commit via "/commits/:sha"