Give default role on Survey creation

This is a different approach than commit de0759e. Now object creators
do not have all access granted anymore. They must have an explicit role
(automatically set on creation). This allow us to remove access if needed
and to give a better overview on who has acces to what in /admin/user/edit/1.
It also simplify RBAC code, getting rid of special cases.

The only downside of this new approach is that a Survey could become orphan
(nobody has access to it anymore). In that case only a direct access to database
could solve the situation. We should ideally try to prevent it when removing the
last role on a survey and warn the user of the situation, but it's not done yet.
Clean up Assertion and expose new 'permissions' property for all objects

Assertions can now be used to assert that our model has a specific state
in addition to role and permission given to user.

REST API now respond to ?fields=permissions by returning an array of
actions and whether it is allowed. This should be used on client side
to enable/disable buttons accordingly