Fixed npe in AcademicAccessRules
Moved remaining pieces of PersistentGroupMembers and UnitFiles to ist-legacy
PersistentRoleGroup can now delegate to any group

  * This is done by keeing the expression in a DML slot
Fixed usage of Person.hasRole