Add a "my consumers" permission.

Only allows the user access to view/edit the consumers they registered.
Add ability for permissions to do some database filtering.

Permissions can add criterion if they're interested in filtering the
class being queried. AbstractHibernateCurator manages the creation of
the secured Criteria, so developers need to be sure to go through this
method rather than grabbing a Criteria directly from the session.
Apply permission query filters as an OR rather than an AND.

Idea here is a multi-org principal would see nothing if he had two
permissions, each restricting the results of the query to different
orgs.
Remove an unused test entitlement cert.
Add query filters for owner permission.

This helps to prevent accidental access to owners a user should not be
able to see.

Behaviour changes slightly for this in situations where you're trying to
get access to something you can't have. A find by primary key will still
return a forbidden, but a find by other properties will now just return
a not found. This is a small net gain in that it hides information about
what exists and what doesn't from the caller. Given this is only for
situations where we're refusing access, it should not affect any
legitemate users or integrating apps.
Add a "my consumers" permission.

Only allows the user access to view/edit the consumers they registered.
Add ability for permissions to do some database filtering.

Permissions can add criterion if they're interested in filtering the
class being queried. AbstractHibernateCurator manages the creation of
the secured Criteria, so developers need to be sure to go through this
method rather than grabbing a Criteria directly from the session.
Apply permission query filters as an OR rather than an AND.

Idea here is a multi-org principal would see nothing if he had two
permissions, each restricting the results of the query to different
orgs.
Remove an unused test entitlement cert.
Add query filters for owner permission.

This helps to prevent accidental access to owners a user should not be
able to see.

Behaviour changes slightly for this in situations where you're trying to
get access to something you can't have. A find by primary key will still
return a forbidden, but a find by other properties will now just return
a not found. This is a small net gain in that it hides information about
what exists and what doesn't from the caller. Given this is only for
situations where we're refusing access, it should not affect any
legitemate users or integrating apps.
Merge branch 'user-perms' of github.com:candlepin/candlepin into ckozak/user-perms

Conflicts:
	src/test/java/org/candlepin/resource/test/OwnerResourceTest.java
Added permissions for other types
Added more secure queries and fixed tests
Checkstyle.
Refactor dev/QE permissions model to support other types.

Previously we only could store owner permissions in our database,
leaving us with no way to store and test other permission setups without
writing customized user services.

Transition to a model where we store a PermissionBlueprint in the
database, which is just enough information for the PermissionFactory to
create a Java Permission object with the data it needs. The Permission
object remains responsible for checking if it has access to some entity.
Merge branch 'master' into dgoodwin/user-perms

Conflicts:
	src/main/resources/db/changelog/changelog-create.xml
	src/main/resources/db/changelog/changelog-update.xml
Begin hooking up username consumer permission.
Merge branch 'master' into dgoodwin/user-perms

Conflicts:
	src/main/java/org/candlepin/resource/ConsumerResource.java
	src/main/java/org/candlepin/resteasy/interceptor/BasicAuth.java
	src/main/resources/db/changelog/changelog-create.xml
	src/main/resources/db/changelog/changelog-update.xml
	src/test/java/org/candlepin/resteasy/interceptor/AuthInterceptorTest.java
	src/test/resources/log4j.properties
Merge branch 'master' into dgoodwin/user-perms
Update missed logger from log4j to slf4j.