create access restriction rule

not applied yet in any controllers
Merge Merge_Resv-RR to master
fix access rules for users
merge calendar to master
merge master to AccessRules
merge Calendar to AccessRules