new authorisation system based on updated ACLs

ObjectACLs can be applied to any object using the Django ContentType
framework. Documentation will be available soon.

Permissions for specific objects can now be checked via the
Django-standard user.has_perm() call. Details will be in docs, too.

Code cleanup opportunities provided by these changes have not been
fully realised yet. Something to look forward to.