Finalizing Auth

Introducing the idea of "blessed" applications. The thinking is that blessed apps will not be limited by any future rate limit and will have access to endpoints that are not available to other apps/users, like `/users` which would list all of the users.

Also adding a simple DSL for authorizing endpoints
```
allow(:index) { allow_if_this_is_truthy }
deny(:show) { deny_if_this_is_truthy }
```