Build out `AuthorizationService` to use `PermissionEntity`s to determine authorization for certain actions
 - some refactoring spilled out into resource methods
 - created `ServiceFactory` to easily create services for tests (rather than calling constructor chains)