Add a flag to reject privileged containers in the apiserver.
Merge pull request #1330 from brendandburns/privilege

Only allow privileged containers if API server flag set.  Adds capabilities package.