RBAC: decoupled rules from assignments and items, implemented php manager

See #499

Work in progress. Do not merge yet.