Fix security for HTTP search

This is the error message I saw when trying to search using security
HTTP.

```
% curl -k --user ryan:ryan 'https://127.0.0.1:10012/yz/search/ryan?q=sugar'
Permission denied: User 'ryan' does not have'yokozuna.search' on {<<"schema">>,
                                                                  <<"ryan">>}
```

HTTP search should check against the index resource, not the schema
resource.

I also renamed the notions of Thing1/Thing2 to be
Resource/SubResource. I'm not sure this makes complete sense either
but it seems like an improvement. Andrew had no problem with the
naming.

Finally I added some more macros around permission names.
Add SECURITY doc

Add document going over resources, permissions, and how to apply
grants for securing Yokozuna indexes and schemas.