fixed some permission bugs and changed some of the redirects for users

- there was an error whenever any users login, but would disappear
if the user refreshes the page. The error was due to some bugs in
the new permissions I had added, superadmin and onlytakeeval(for
tutors and students), The problem seemed to disappear once I put
the permission under 'functions' instead of 'root'.

- due to the "change" in permissions, I had to go through many of
the controllers to make the minor changes.

- I have also condensed the code in emailer controller when checking
whether an instructor can email to specific students, tutors, and
instructors. Instead of using very similar find functions. I have
condensed it to a for loop that loops through the three different
models (UserCourse, UserTutor, UserEnrol) to create the accessible
users list.

- fixed the problem where courses that (for whatever reason) does
not belong to any departments/faculties would not show up in the
course list for super admins. This is due to super admins' course
list was originally generated by the faculties they have access
to (eg. all). To fix this I have just used find('list') to generate
the list for super admins.

- I had made some changes to the users controller, which is due to
instructors no longer have access to the users index. Generally,
previously, most of the redirects go to users index (from add, edit,
delete, etc). Which was alright before because all users that could
access those functions have access to the users index.

- changes have been made to now redirect to index if the user is
an admin or super admin and goToClassList if the user is an instructor
(generally speaking). The exceptions are the functions goToClassList
and view. goToClassList will redirect to courses/index if access is
denied, because the permission is mostly based on whether the user
has access to the course.

- For view, it still redirects to users/index because it only redirects
if permission is denied. Generally speaking users would only see links
users if the have permission to view them. Super admins and faculty
admins can view all users, therefore has access to the users/index.
While instructors generally speaking will access the view page from
the class list or group members list, which only lists users they
have access to.

- To implement this for functions add, edit, delete, and reset password,
a new parameter is added, $courseId (optional). If a courseId is provided,
the user would be redirected to the that course's class list. If not,
the user would be redirected to the index.

- Generally speaking, instructors would access the functions through
the course home page or class list, which makes it convenient for them
if they are redirected to the class list. Meanwhile, it would be
convenient for admins to be redirected to the users/index when they
access the functions from there.

- For the minimal chance of an instructor typing in the url to the functions
without the courseId, they would be redirected to the home page. This is
because they would be redirected to users/index and be denied access and
be further redirected to the homepage.

- For the above changes, we need add.ctp and edit.ctp to return the original
url instead of the url without parameters. To do this, I've added the
attribute url with the input $this->Html->url() to the create function.

- Lastly, a new button has been added to the add user form. The first
button is the original save button that saves the user and redirects
the user. The second button (new) saves the user and "refreshes" the
form for the user to add a new user.