Access control

Merged in the AccessControl work I did refactoring and adding logging.  Originally these were in CoreAccessControl and AdminUIAccessControl classes, but it was suggested I should merge it all in rather than maintaining separate classes.  This also rearranges the inheritance a little so BaseAccessControl has the effect of NullAccessControl and all classes add to and override functions from Base to extend functionality.
Are you sure all SUID flows have a valid token?  I see token=None in a few places in the code, I wonder if they wind up calling these...Was it intentional to put the token validation before this?