API Allow group-based permissions to be applied

This update means that group-based permissions can be applied instead of having to assign permissions on a per-user basis.

This can be useful in a site with many users, or where user-roles are not immediately identifiable from username, or where permissions are more appropriate to manage via groups.

This also replaces the many-checkbox based interface with the chosen-multiselect field.

![image](https://cloud.githubusercontent.com/assets/936064/4453511/e753da4a-485d-11e4-8637-afac4cdb815e.png)