Authorisation business rules.
Convenience function for authorisation checks in BaseController.
Functions to do authorisation checks for events in BaseController.
RBAC for PatientController.
Remove access_level check from UserIdentity.
Tidy up default access rules.

 * Default deny in BaseController, no need for default admin allow as everything now goes through RBAC
 * Default allow for admin in WebUser
Remove obsolete methods.
RBAC for BaseEventTypeController.