Rspec tests passing, access_to and accessible_scopes built and tested

Not our usual 1000-line PR, but necessary to implement the controller tests that Mert will be working on. The implementation can be optimized (it's O(n^2) now, where n is # of record sections) pending how we implement getting the relevant record sections for a user.