RBAC for PatientController.
RBAC for base event controllers.
RBAC for remaining core controllers.
Tidy up default access rules.

 * Default deny in BaseController, no need for default admin allow as everything now goes through RBAC
 * Default allow for admin in AuthManager
Remove obsolete methods.
Remove access_level and remaining references to it.
Support for getting and setting roles in User model.
Role assignment in user admin tool.