sf.php api refactoring wip

user and project commands created and moved out of sf.php as necessary
finished moving code out of sf.php into commands (tests passing)

Tests were fixed up to accommodate the new signature of some commands (in most cases just passing in a bogus userid string).  These tests will need to be fixed once the roles/permissions checks are implemented for each command/dto
moved register and get_captcha_src out to userCommands
added tests for ProjectSettingsModel taking into account user role
trying to fix errors due to missing "use" statements
moved private methods to bottom
added UserUnauthorizedException and stub for RightsHelper::userCanAccessMethod()
roles refactor (renamed _OTHER)

EDIT_OTHER is now just EDIT
DELETE_OTHER is now just DELETE
... etc.
implemented RightsHelper::userCanAccessMethod()

the userCanAccessMethod is the authoritative place to define the permissions for a particular API method.
See https://trello.com/c/p3k8vmoq/294-define-user-authorization-rules-for-each-api-method for details
removed parameterization of current user id from most commands (unless they need them for more fine-grained permissions checking)

this was my former idea of implementing security for every method, but I decided against it in favor of checking at the JSON RPC server level.  the code is cleaner this way too.
updated email validation success template to look like registration success template
fixed up tests
improvements and fixes to RightsHelper::userCanAccessMethod() and a few tests
removed commented out methods and comments
canUserAccessMethod() now throws Exception on unknown method
removed API tests and reimplemented as Command/DTO tests

This still keeps the spirit of the API tests in that they test basic CRUD functionality
added support for private and read-only properties on Models
Merge branch 'refactor/apicommands'
fixed user and project models to remove references to each other when deleting
bug fixes from refactor