Klass API and access policies

Includes the API pull request.

Also includes some extra stuff, like access policies for students, courses and schools and their specs.
I think the problem with moving the `UserAccessPolicy` `:read_tasks` check here is what do we do when we're checking access for `/students/123/tasks` and the like?  There are many `:index` requests for `Tasks`.