Migration to add RBAC authitems.
Check for OprnLogin at login.
Access rules for SiteController.
Authorisation business rules.
Convenience function for authorisation checks in BaseController.
Functions to do authorisation checks for events in BaseController.
RBAC for PatientController.
RBAC for base event controllers.
RBAC for remaining core controllers.
Tidy up default access rules.

 * Default deny in BaseController, no need for default admin allow as everything now goes through RBAC
 * Default allow for admin in AuthManager
Remove obsolete methods.
Remove access_level and remaining references to it.
Support for getting and setting roles in User model.
Role assignment in user admin tool.