Remove unneeded/undesired `xxf:refresh-items="false"`

- misplaced on itemset
- or incorrect (e.g. for schema types in FB)
- not a big deal anyway
Fix #695 "Permissions not saved"
Minor
Fix #696 "User with only Create role can see forms on summary page"

Also:

- use 403 instead of 401
- set "home" mode for home page