Initial commit for authorization stuff.

Most actions should now be authorized through checking the user's
metaroles.