[#912] Object permissions based on django-rules

A new object level permissions system is now in place, which contains:
- A rule based system (rules defined in permissions.py)
- Auth.group is now linked to rsr.Employment
- A new field on User level, 'is_admin', for general RSR admins aka Akvo employees
- Four new Groups: Admins, User managers, Project editors and Users
- The admin corresponds to the permissions, showing only the models and objects that a user can add or edit
[#912] Assign Group to Employment in MyRSR

Changed the MyRSR page so that a user can select a Group for every Employment (but only if allowed).
The API now also checks if a user is allowed to change that particular employment.
[#912] Small update to show 'Loading...' when updating Group
[#912] Object level permissions in REST API

Updated the REST API to work with object level permissions. Also made updates to MyRSR to set any Group, updated signals.py for updating users when their Employment is adjusted or created and cleaned up old permissions.
[#912] Added dismissable alerts and better error messages in MyRSR
[#912] Re-added RSR limited change permissions for TastyPie
[#912] Added object based permissions on My Projects page
[#912] is_self predicate now returns False if user != self
Merge pull request #927 from akvo/feature/912_v3_rules

[#912] Object level permissions