Remove some unnecessary database calls.
Tidy up and tighten auth rules.

 * Simplify canEditEpisode
 * canCreateEvent and canEditEvent now call canEditEpisode
Remove admin default allow from AuthManager.
Add OprnEditEpisodes as a general check for ability to edit episodes.