Add more permissions tests

* Includes `login-fixes` branch
* Includes some `CheckboxTree` behavior changes - now calling `fill` on a CheckboxTree with a list will always assume the list is of boxes to check or uncheck, never just selecting a path.  To select a path, just use a Tree.  I don't know of any UI elements where you need both behaviors.
* One more basic permission test
* Two permission tests in other modules that verify actual CRUD-type operations only work when you have the appropriate permissions
Assert should happen inside ``create()``