Expand ACL testing

[Nicholas Skaggs]

We need to cover all of the edge cases and other potential security risk scenarios to prevent things like privilege escalation, improper model access, and other bugs.

Let's add tests to cover

admin@local
-login
-logout
-administer controller
-register controller as an admin
-add/remove users
-remove admin privileges
-grant admin privileges

read-user
-attempt privilege escalation to a write or admin user

write-user
-attempt privilege escalation to an admin

external-user
-attempt to manipulate controller
-attempt to view/modify another model on controller
-auth token manipulation