Standardizing protected/private variable naming
Refactor GET and PUT /posts/:id to share post loading code

* We use this to simplify run the access checks against that post too.
* Load post using resource() with actual work done in _resource()
* Override _resource for special loading behaviour
Move OAuth2 scopes and realm name to config file
Add ACL rules for sets and tags, and add access checks too

* Override _resource() for Sets and Posts controllers
* Allow users to create sets
* Allow users to edit own sets
* Allow users to view sets and tags
Add access checks to Forms api

* Override _resource() and centralise loading the
  form for get/put/post/delete requests
Share code between Form create and update.
Remove unneeded 2nd values() call in sets and tags api
Reduce duplication of groups/attributes handling in Forms API

Keep group and attribute objects after validation and the loop through
them to save. Previously object were discarded after validation
and recreated to save leaving room for errors and mismatches in values
set.
Allow reusing existing attributes during form creation.
API forms/:id/group/:id/attributes - forward attribute creation to /attributes api

Use HMVC to pass request on to /attributes API
Refactor Groups and Attributes API to share code between PUT and POST request