Add basic authorization.

Added basic interface for authorizer implementations.
Added default "authorize everything" implementation.
Added authorization checks in each REST handler routine.
Added tests that these routines return forbidden error code
when the authorizer implementation denies access.


Anyone writing tools that extend the rest api I assume.  I guess authorizer doesn't seem like it's specific to apiserver, and these are methods that test frameworks would use as well.