fixes #2248 adds api controllers and actions to access_permissions.rb
fixes #2421 added missing associations and missing :dependent => destroy in models
fixes #2422 Rails 3.2: before_destroy / dependent => :destroy ordering
clean up tests so there are no orphaned foreign keys