Migration for RBAC.
Remove access_level check from UserIdentity.
Tidy up default access rules.

 * Default deny in BaseController, no need for default admin allow as everything should go through RBAC
 * Default allow for admin in WebUser
 * Remove unused isAdmin method

squash! c18aeee35e96b55fa3762e1d5ef46fbdebbb3db0
Structured business rules for authorisation.
Convenience function for authorisation checks in BaseController.
Functions to do authorisation checks for events in BaseController.
Remove obsolete methods.
RBAC for Patient controller.