Classification permissions

Adds permission controls for classifications. 
I'm in favour of changing the UserGroup -> User binding if it isn't already set up like that. I think it'll make it much harder to make mistakes where we expose user group data to users who are not active members if we make sure the default relationships are only for active members.