Fix authn rules

There were issues around history and fetching and around updating editable on the entities based on programme and project roles.

Fixes #269