extra validation rules + access embeds

An access control helper is now embeded into the entries returned by the
various collection interface helpers (including the hierarchy ones).

Extra validation rules have been introduced.
deprecated push/update + working tree_update

The default push and update methods have been deprecated for TAccounts and
will throw an exception indicating how they are not safe to use. The
tree_update method is fully working and allows for partial input.