[#818] User roles and permissions

* Add management of user roles and permissions
* Hide survey definitions and survey response data depending on user authorization
It turns out we don't need to add the access decision manager for the API end points as the filtering is done in the `SurveyGroupDAO` and `SurveyDAO` methods.  But I had to make some changes to pass through the `userId` for API requests as well, as its needed for this filtering.