Initial demo of rewriter based  row security

lacks recursion detection (but that looks easy now), plan invalidation so far