Feature/entitlements

This implements the Entitlements scheme proposal by @ahgittin
It add entitlement checks for ApplicationResource and EntityResource only, to verify that direction is right.


again, maybe should be `INVOKE_DELETE` ?  though here maybe okay to pretend it's an effector... whatever you think