Classification permissions

Adds permission controls for classifications. 
I think the most common use case is going to be active groups, and so should be the default. If we need to enumerate all groups, we can always add a `has_many :all_user_groups, through: :memberships`