Fix access to plugin administration pages
Users can access plugin administration pages (e.g. /admin/plugin/vote) even if they aren't environment administrators.
This MR create a new base controller for plugins that protects by default against improper access for these pages.