Add a model function to determine if admission is allowed.

Put this once in the model so we don't wind up repeating this business
logic everywhere. Alternative would be to push down to the database with
a view.