Authorization features, implementation of #538

I started a possible implementation of what I told you in #538, I tried to be as generic as possible and to minimize changes to the current codebase.

I'll wait for a review by you and if the implementation is fine for you I'll finish the PR adding resource checks for missing controllers.

Let me know what do you think.