529 cancan metadata

Adds authorization to the metadata sub-controllers.

This branch is based on augmenting228. #526 has to be merged prior to merging 529.