CRM-15713 - Case ajax fixes

Also: getCases() includes a filter on case_status (which excludes closed cases). It seems OK to block write access on closed cases, but I don't think we'd want to block read access on closed cases.