Permissions update

Old access level mechanism was not very elegant. This replaces how permissions are handled with a more extensible method of handling permissions. Also provides a method to manually assign someone permissions without worrying about house positions.

Database changes:
- New table `office_permissions`
- New table `user_permissions`
- Will remove `access_level` from `offices`
Can we make a wrapper function, since I assume we'll be doing `Permissions._ in session['permissions']` fairly often. This way, if we ever change how we check permissions, we don't need to update it in every place. Maybe like `session['username'] == username or auth.hasPermission(Permissions.UserAdmin)`