properly lock down APIs by role

for users, web users and apps, the role was clear

for cases and forms, currently requiring edit data permission, though
we may want to consider breaking this out to new permissions
whitespace
cleanup
actually make domain admin authorization work
remove printout
Merge pull request #2636 from dimagi/api-permissions

properly lock down APIs by role