add entitlements to EffectorResource

`getEntity` will check whether the **entity** is visible, but not whether we're entitled to invoke this **effector**, no?