Permissions and access system

This pull request adds the following:

### 3 Tier Security System
* Exclude option renamed to private
* Protected option added
* Access option added 
  * Access is a function that receives the request object and returns or yields a string value of 'private', 'protected', or   'public'
  * The result of access is attached to the request object and used to figure which fields to exclude
  * Fields are filtered on input AND output so that unauthorized users cannot modify fields they are not entitled to.


### Request permission system
 * Prereq option - A function that receives the req object and yields or returns a boolean. If the result is false, the request is interrupted with a 403 error. Otherwise, the request proceeds as usual.


Let me know what you think. One possible concern is using private and protected as key names for the options. Those are reserved JS keywords, but they are well understood in programming and made the most sense to me.