handle PUT/POST/DELETE to /data/fs/[path] (Fixes #140)

Replacing the earlier PR (#152)
This method is of course necessary for the front-end. I'm just concerned with the idea of analysts or developers blowing away an entire database's contents accidentally. We'll solve this issue "for real" with authentication / authorization as part of the Apache Shiro / Spring Security work, but until then, is there something easy and reliable we can do to prevent users from deleting collections not created by SlamData? If not, we can live with it for now, at least until the production release.