ActionFinish in the API

Last mile of the ActionFinish function to the API
what's the distinction between the `unitTag != whichUnit` and the `!canAccess(unitTag)`? The latter's meant to exist so that people don't embed assumptions about permissions (like the former) into the implementations -- all such decisions are deferred to the AuthFunc alone.