Implement opt-in CRUD for feature sources. The behaviour is now as follows:

 * Insert requests are rejected unless _MgRestAllowInsert = 1 in the resource header
 * Update requests are rejected unless _MgRestAllowUpdate = 1 in the resource header
 * Delete requests are rejected unless _MgRestAllowDelete = 1 in the resource header

Added CRUD tests to exercise this behaviour. In the process we discovered there is no way to set resource headers through this REST API, so a new route was added to enable this as well.

Fixes #9