Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
I'd rather see us not re-use verb strings but instead make these more hierarchical

```
core.pods.read
core.pods.write
core.services.read
core.services.write
```

If users want to write policy across a group of verbs they could do easy globbing as in `core.*.read`.