UK: code refactor: call check object permissions
UK: add xform permissions, for manager role
UK: make tags, bamboo_dataset, last_submission_time read only for XFormSerializer
UK: test user with manager role can change xform