Migration for RBAC.
Tidy up default access rules.

 * Default deny in BaseController
 * Default allow for admin in WebUser
 * Remove unused isAdmin method
Structured business rules for authorisation.
Patient controller updates.
Remove obsolete methods.