ACL by user

patient referral

fixed wrong sorting for MySQL

some refactoring