user without proper rights cannot attempt to modify configuration paramters, and sees only client side parameters

This sript refreshes all GET queries. Because of that some tests had to be modified. And api resposnes are reproducible now (sets results are changed to a "sorted" set, so with every query we should have the same response).
Second big change is that overlay iamages are stored differently (there are no overlays in submaps anymore)

project privileges are set according to user defaults (or general defaults if user specific not defined)