Access control exception handling

This provides handling for access denied exceptions. Treats protected jcr:content nodes as invisible for now, in the parent's graph representation. Other child nodes are already silently omitted. REST operations all return 403 when access is forbidden.