[WIP] Carles/312 api security

This is work in progress: API base classes for security and ownership checks.
For review, I will keep extending and adding a more complete set of tests.