Migration for RBAC.
Tidy up default access rules.

 * Default deny in BaseController
 * Default allow for admin in WebUser
 * Remove unused isAdmin method
Structured business rules for authorisation.
Convenience function for authorisation checks in BaseController.
Functions to do authorisation checks for events in BaseController.
Remove obsolete methods.
Patient controller updates.