Add AccessManager/AccessController and REST api

- AccessController says whether operations are permitted, such as
  provisioning new locations, and managing new locations/entities
- AccessManager allows the controller rules to be configured
- AccessApi and AccessResource presents this in the REST api