RBAC for BaseEventTypeController.
Tidy up default access rules.

 * Default deny in BaseController, no need for default admin allow as everything now goes through RBAC
 * Default allow for admin in WebUser
Remove obsolete methods.
Remove access_level and remaining references to it.