Feature/entitlements

This implements the Entitlements scheme proposal by @ahgittin
It add entitlement checks for ApplicationResource and EntityResource only, to verify that direction is right.


`HasSeeEntityEntitlement` ?

also, should probably implement `Predicate<Entity>`, and get called recursively when we look at children also