Add system roles for default resource context. Enforce access controls
on default resource context. Add behave tests that prove enforcement
works. Add migration so that users don't lose the access they already
have.
Fix check for private and null context on post of a private program.
Merge branch 'develop' into feature/system-roles
Merge branch 'feature/mapping-cleanup' into feature/system-roles
Now with authorizations widget in admin dashboard.
Fix role assignment migration so that current users are object editors
and program creators and don't lose rights.
Fix migration to execute the lookup for ProgramCreator role.
The created_at and modified_at fields must be set in the migration.
Fixing db update typos
Exposing Role.scope to the frontend
Added scope filtering to authorizations widget

Will always use the scope for the current page to filter the available
roles
Added role scope editing
Changed system roles so that they can't be created or have their scope changed
Fixing issues with client-side permission enforcement (as well as permissions serialization)
Added item-specific read access blocking and "no access" messages
Hiding the edit link for system roles
Fixed issues with LHN read access
Renaming the read-only user for usability
Merge branch 'develop' into feature/system-roles
Fixes for permissions on left hand nav because permissions aren't set in
session yet. Also, when checking for admin permission, check if the user
has System Admin permissions, too.