[IMP] add read access to all users for product.pricelist.type

In new API, selection field value is checked (against the selection's possible
values) at both read and write. For pricelist.type this requires read access
to product.pricelist.type.
[ADD] demonstrate broken handling of rules access denial in new API
[FIX] only prefetch other cached records with read field uncached during _read_from_database

If expansion of the recordset is done during _prefetch_field, if one of the
prefetches (not the base record(s) but one of those selected by
BaseModel._in_cache_without) can't be read by the current user (due to an
access rule or for field reading reasons, or whatever) the whole read is
failed, even if the record which was specifically asked for could be read on
its own.

By only expanding the read set in _read_from_database, the cache is correctly
set but read() and _prefetch_field() only check the records explicitly asked
for for AccessDenied, prefetched records will only be asked if they are ever
accessed.

fixes #1013
[FIX] filtering out of records which shouldn't be fetched/prefetched

A todo would only filter out records selectioned by the same field's caching,
it should filter out on the whole prefetching selection or an other field
could/would just add it back to the set of records to fetch (and lead to Bad
Things).

Note: this probably deserves a test somehow, but I'm not quite sure how the
todos thing works so...
[REM] cache setting in _prefetch_field
[FIX] calendar: invalidate cache to avoid (pre)fetching invalid virtual IDs

Because the new API basically browses everything, the virtual IDs used by
calendar.event are added to the cache and prefetching tries to get them from
the database resulting in conversion errors. These ids have to be forcibly
evicted to avoid the error.
[FIX] expected browse_record can be an integer

If no filter is specified, the geoip library is installed and the user's
address can be geolocated, ``country`` is assigned an integer (the id of the
matching country) whereas the filtering code expects a browse.

fixes #1148
[FIX] website_hr_recruitment: various warnings
[REM] asynchronous database creation method

It's broken (though easy to fix) and not very useful, if third parties want to
create databases asynchronously they can handle the asynchronicity on the
client-side (an HTTP request is easy to make asynchronously after all) and
call the synchronous `create_database()`.

fixes #1137, after a fashion
[IMP] website_hr_recruitment: new API
Merge pull request #1076 from xmo-odoo/8.0-shop-fix-xmo

Fix access rights issues in new API for the shop home page
Merge pull request #1166 from xmo-odoo/8.0-jobs-list-geo-xmo

8.0 jobs list geo xmo
Merge pull request #1169 from xmo-odoo/8.0-remove-async-db-create-xmo

Remove asynchronous XML-RPC database creation function