restrict marshall descriptors

`wrapLocal` in a marshall descriptor must now be:

 - a published API function on the server
 - a whitelisted [module,fn] pair on the client
restrict marshall descriptors

`wrapLocal` in a marshall descriptor must now be:

 - a published API function on the server
 - a whitelisted [module,fn] pair on the client
version 0.5.1
Merge branch '0.5' (early part)
Merge branch '0.5'
docs
update manifest
Merge branch '0.5'