Permissions

Model layer is updated with permissions and user groups, and scripts to create the necessary groups. 

There's been talk of changing the way the groups are implemented; not sure how it would work architecturally using only one group, base users and superusers, and this might actually be more useful to us; happy to change it later or now. 

The features work and we have a basic page for changing permissions; worth a merge?
Was some missing functionality I'd intended to add in afterward; now implemented.