first stab at new authorization subsystem, refs #1297. Uses checkPermissions() right now, that should maybe be checkAuthorization() instead. I have an AgaviRunActionFilter sitting around that implements the old behavior, but I am not sure how useful that even is... More to come. Also, Internet on planes for great justice.