Migration for RBAC.
Remove access_level check from UserIdentity.
Tidy up default access rules.

 * Default deny in BaseController
 * Default allow for admin in WebUser
 * Remove unused isAdmin method
Structured business rules for authorisation.
Convenience function for authorisation checks in BaseController.
Functions to do authorisation checks for events in BaseController.
Remove obsolete methods.
RBAC for Patient controller.