Fixed bug in data-grid new record model creation

1.Backbone 1.0 has a new default url() function for models which
prioritizes the urlRoot before the collection.url, we switched it back.
2. Problem on server exposed:(security)
if a record has a 'refedBy key' to its parent record, a direct delete
url to its id should be rejected! so in other words, a user has the
direct data access permission to the record table also should have the
permission on the refed data access permission.