do not enforce default permissions on exception views

- this normalizes the behavior to work similar to require_csrf

- if an explicit permission= is set on the view it will still be enforced,
  this just affects a default permission via config.set_default_permission

- permission=NO_PERMISSION_REQUIRED was already forced on for notfound
  and forbidden views, this just helps out with other exception views