Classification permissions

Adds permission controls for classifications. 
So when i read something like this `User.find(1).user_groups` i don't think only active_user_groups. I assume that that will return any where the has_many condition is fulfilled. Reading the User class has_many relation definition would correct me but I think the intention of the method (thus naming) is important. 

Also what about the inverse relation from UserGroup -> User, do we only want to see active users in a user group?