Klass API and access policies

Includes the API pull request.

Also includes some extra stuff, like access policies for students, courses and schools and their specs.
Whoa.  That could be a lot of checking.  When :read_tasks was in UserAccessPolicy it doesn't have to go through all of the records.