properly lock down APIs by role

for users, web users and apps, the role was clear

for cases and forms, currently requiring edit data permission, though we may want to consider breaking this out to new permissions.

also fixed the repeater authorization not actually checking what it was supposed to be checking.