allow authz to be selectively turned on/off
Rename maybe_skip_authz to use_custom_acls
Always use custom_acl checks when the requestor is a #chef_user{}
Added 'custom_acls_always_for_modification' configuration flag.

Defaults to true, and when true means that we always use custom ACLs
for non-GET methods regardless of the setting of custom_acls_FOO
settings

This trades some performance for better security.
review comments. updated customize_for_modification logic to make it clearer
Fix it so that the webmachine call is correct in customiuze_for_mod_maybe
First cut at tests around use_custom_acls. Fails on depsolver POST
Added more tests and DRYed them up
use_custom_acls now understands which methods on endpoints are
for modification or not.
- Add tests around use_custom_acls code
- Add logic such that depsolver POST is considered a read operation
Fix spec for use_custom_acls
Merge branch 'selective-authz'