restrict marshall descriptors

`wrapLocal` in a marshall descriptor must now be:

 - a published API function on the server
 - a whitelisted [module,fn] pair on the client
version 0.5.1
update manifest