Feature/entitlements

This implements the Entitlements scheme proposal by @ahgittin
It add entitlement checks for ApplicationResource and EntityResource only, to verify that direction is right.


maybe this should be a new permission `CREATE_APP` taking item type `ApplicationSpec` ?