SSP-1510, SSP-1507 Fix person search permission assertions

Was using a SpringSecurity permission check expression in
ScurityService.hasAuthority() rather than the actual name of
the permission (ROLE_PERSON_READ).

Also allows access to person search APIs if the caller has
*ether* ROLE_PERSON_READ or ROLE_PERSON_SEARCH_READ.