Change auth

Don't merge yet; this is just an experimental idea of how to do authentication. 
This is the main api. You ask a user if it's allowed to access a particular object.