Permissions

Model layer is updated with permissions and user groups, and scripts to create the necessary groups. 

There's been talk of changing the way the groups are implemented; not sure how it would work architecturally using only one group, base users and superusers, and this might actually be more useful to us; happy to change it later or now. 

The features work and we have a basic page for changing permissions; worth a merge?