Feature/entitlements

This implements the Entitlements scheme proposal by @ahgittin
It add entitlement checks for ApplicationResource and EntityResource only, to verify that direction is right.


could share with the `ApplicationResource` instance.  will have to make static but easy enough to pass in `mgmt()`.