ServiceBrokers controller uses allowy for access control

and extends ModelController, for consistency with other controllers.
Add testing of :index permission for Access classes.
[#61513830]