Remove rest client doc, now lives in its own repo
Request timing and debug output.
Radically simplify the permissions management code.