Migration to add RBAC authitems.
Access rules for SiteController.
Authorisation business rules.
Convenience function for authorisation checks in BaseController.
Functions to do authorisation checks for events in BaseController.
RBAC for PatientController.
Remove access_level check from UserIdentity.
Tidy up default access rules.

 * Default deny in BaseController, no need for default admin allow as everything now goes through RBAC
 * Default allow for admin in WebUser
Remove obsolete methods.