We now have QL Properties

A QL Property should contain a single QL Phrase.  When referenced, it
applies that QL to the incoming Context, and returns a new Context with
the result.
Added Email Message.Recipients

This is the long-desired indirection, so you don't necessarily have to
specify the recipients of an email explicitly, one by one.  This QL
Property returns the list of people to send to, and can be edited as
desired.

Also added PropValue.flatMap(), refactored out of Property.  This
requires explicitly stating the PType, but it's better than nothing.

Fixed a bug in setting up the Edit form -- the DisplayPropVal would
sometimes use a Model instead of the Thing in naming the fields, which
caused things to fail to register when parsing the submitted form.
Introduce Space version numbers

These will allow us to manage controlled evolution of the Spaces.  In
theory, when we load a Space, we will check the version number, and
evolve the Space if the version is old.
Introduce Space version numbers

These will allow us to manage controlled evolution of the Spaces.  In
theory, when we load a Space, we will check the version number, and
evolve the Space if the version is old.
Very beginnings of access control

For the moment, we just have a horrible hack: anyone who gets in through
an Invite Link can edit the Space.  That'll do for the Wedding RSVPs,
but it needs to be improved ASAP.

Major improvement, though: we are now passing proper User objects
around, not just OIDs.  This lets us be more sophisticated in our
processing of ACLs, and should reduce redundant lookups.