Audit permissions on controller, and make some methods as private/protected: refs #658  #318
Merge branch 'dev' of github.com:projestimate/projestimate into dev