Migration for RBAC.
Structured business rules for authorisation.
TaskEditEpisode.
Allow admin access to everything in WebUser, and deny everyone else by default in BaseController.
WIP.