permissions model created to handle the controllers and actions that can be hit for guest, patient, doctor etc.
permissions spec'd for the guest
patients and doctors permissions specced out at the model layer - next refactor the whitelisted actions and controllers into a cleaner implementation and the modularise the permission model