Added some authorization methods

These methods map exactly to the way Django does things.  The only thing
we are really missing is the "read" permission.  However, that part is
tricky because it interacts with the QuerySet objects.  For that reason,
I left it out (upt to this point) to focus on the ones that were pretty
straightforward.

This includes some extensive tests for these permissions checks.
Added support for read permissions.

The read permission is different than the other permissions because
it has to hook into the QuerySet system.  I implemented this in such
a way that the `has_read_permission` method is given a QuerySet and
returns a QuerySet of objects that the given request should have
read access to.  The default behavior is, of course, to just return
the initial QuerySet.

I added a test for this behavior as well.
Trying to add some documentations so others can follow what I did here

Tried to add comments and docstrings to explain what was going on in
this set of commits.
Cloning QuerySets

I didn't notice before that the QuerySet objects have internal state.
I assumed that each time you applied a filter, a new QuerySet object
was created, but this isn't the case.  So when calling has_read_permission
it is necessary to clone the queryset to avoid side-effects.
Merge pull request #26 from xogeny/richer_authorization

Richer authorization.  remember to add yourself to the AUTHORS file @mtiller!