Portal user had too many access right on sensitive documents in this modules. Some ir.rule were missing, and some model access were useless. This commit clean all access right: ir.rule, ir.model.access and remove useless check in python code. Also, some tests were added to check access rights.