Added is_allowed mustache helper for permissions
is_allowed helper now defaults resource_type/context_id to the page object's values
Updated is_allowed helper to parse more arguments

0..n actions
0..1 resource_type
0..1 context_id
Tweaked is_allowed for non-Program pages, added is_allowed check for all tree sections
Added permission check for deleting mappings
Merge pull request #275 from reciprocity/feature/rbac_private_program

Added RBAC permissions checks for private programs (and is_allowed Mustache helper)