Add basic authorization.

Added basic interface for authorizer implementations.
Added default "authorize everything" implementation.
Added authorization checks in each REST handler routine.
Added tests that these routines return forbidden error code
when the authorizer implementation denies access.


Direction looks fine - I *think* you could potentially simplify the handler code a bit by providing the following syntax instead:

    watchHandler := authorizer.HTTPHandler(&WatchHandler{...}, watchAuthorizer)
    
    ...

    func watchAuthorizer(req) *Attributes {
      // converts a req into Attributes
    }

This would then allow HTTPHandler to do the common block of:

	attribs := attrib(req)
	if err := h.authzer.Authorize(attribs); err != nil {
		forbidden(w, req)
		return
	}