[#912] Object level permissions

Implemented object level permissions based on django-rules:

- A rule based system (rules defined in permissions.py).
- Auth.group is now linked to rsr.Employment.
- A new field on User level, 'is_admin', for general RSR admins aka Akvo employees.
- Four new Groups: Admins, User managers, Project editors and Users.
- The admin corresponds to the permissions, showing only the models and objects that a user can add or edit.
- Changed the MyRSR page so that a user can select a Group for every Employment (but only if allowed).
- Updated the REST API to work with object level permissions. 
- Updated signals.py for updating users when their Employment is adjusted or created and cleaned up old permissions.
- Added dismissable alerts and better error messages in MyRSR.
- Added object based permissions on My Projects page.