Permissions checking

Permissions can be granted and revoked on contacts and teams.  Grants
and revokes are inherited from teams.  Grants override revokes.

Grants and revokes can use a wildcard and permissions are expected
to be heirarchial dotted strings.

We currently define the 'ui.login' permission which needs to be granted
to allow a contact to be able to login to the UI.