Resource index allowed? first cut.
Added core.match.
Added data getting for index-allowed?
Added tests for authn.
Handle missing entities properly in *-allowed?

If the programme_id and project_id can't be found then the entity
doesn't exist so returning true as anyone can do things to something
that doesn't exist. Other methods will return how the missing resource
should be handled.
Merge pull request #79 from MastodonC/feature/further-authz

Feature/further authz