Add a "create" permission to redhen connection roles.

Determining create access is different from other access checks because there's no extant entity to examine. This actually turns out to be pretty easy as a result.