Add AccessManager/AccessController and REST api

- AccessController says whether operations are permitted, such as
  provisioning new locations, and managing new locations/entities
- AccessManager allows the controller rules to be configured
- AccessApi and AccessResource presents this in the REST api
Merge pull request #937 from aledsage/feature/access-control

Add AccessManager/AccessController and REST api