Restrict ordering by exam

To control which exams a referrer may request via the Cris Orders application, apply a restriction, in the form of a list of permitted exam codes, via core Cris. The referrer must be added to the Cris Staff table as well as the Referrers table.