Richer authorization

This pull request adds a collection of methods that enable a much richer set of
permissions for views.

It follows the Django model very closely by adding `has_change_permission`, `has_add_permission` and `has_delete_permission` to the `ResourceView` class.
The signature for these methods is the same as in Django, each gets the `request`
object and the MongoEngine object as arguments in order to make its determination.

I also added a `has_read_permission`, but this methods works differently.  This is
because when requesting collections of objects from the database, you don't want
to consider each object in turn.  Instead, you want to affect the database query.
For that reason, `has_read_permission` is passed the `request` object and a
`QuerySet` object and returns a (potentially altered) `QuerySet` object that is then
used when fetching records from the database.  This allows the results to be
filtered based on the details of the request (who made it, what they were asking
for, etc).

Finally, I added tests for all this functionality.  Those tests include a special
"restricted" view of the `Post` objects in the example app.

I tried to comment all the code being submitted so it was clear what was going
on or what was being tested.