Klass API and access policies

Includes the API pull request.

Also includes some extra stuff, like access policies for students, courses and schools and their specs.
A `course` doesn't have to have a `school`, so I don't think we can have those as required in the route.