Tidy up default access rules.

 * Default deny in BaseController, no need for default admin allow as everything should go through RBAC
 * Default allow for admin in WebUser
 * Remove unused isAdmin method
Structured business rules for authorisation.
Convenience function for authorisation checks in BaseController.
Functions to do authorisation checks for events in BaseController.
Remove obsolete methods.
RBAC for Patient controller.