Classification permissions

Adds permission controls for classifications. 
Why not just use the User#has_many active_memberships in the query? we might wan't to enumerate all the inactive user_groups via this relation.