let actions go through PEP (for testing provenance, we commented a part for ignoring policies, now we uncomment this part)
let other methods go through PEP (not just getPatient method now. But,still need to TEST)
add PatientAssignment resource to allow assigning patients to doctors (because we want to assign patient through REST, and we can not change the Patient resource in OpenMRS)