added features, fixed a bug

added `req.locals.query_options` this allows middleware to insert additional query limitations, useful for authenticated api

added `options.idValidator` in case the id has been configured to use something other than integers, this allows for id validation.

fixed, throws a descriptive error if using `option.allowed` with an unknown model