mqtt: redo access control checks from external client; don't change topics named like 'site/xyz/foo/bar'
m_identity: allow binary admin username.
core: add m_category:foreach/3 and m_category:fold/4