Klass API and access policies

Includes the API pull request.

Also includes some extra stuff, like access policies for students, courses and schools and their specs.
I'm fine with going back to TaskProperties if you want. In either case, we need to think how to print this schema and the others together for, say, GET /tasks/1