Metacat

add CNRestServlet and mappings for urls in the form:
/d1/cn/*
This extends existing code for CN-specific handling. MN handling will be analogous and is forthcoming

share the deserializer method with subclasses

throw NotAllowed in MNodeService.delete() when isAuthorized() returns false.

Implement the MNStorage.delete() MNodeService. There is debate about what permissions are needed to 'delete' an object (archive it in metacat terms): D1 'WRITE' (metacat 'write') or D1 CHANGE_PERMISSION (metacat 'all'). For now we are using CHANGE_PERMISSION until it is ironed out.

add shared operations for authorization

share tempDir method with subclasses

make RestServlet and ResourceHandler extendible for D1 CN and MN handlers

use session member variable now that we actually have it

isAuthorized: check for nulls in Session subjects, catch any unexpected errors and deny access when in doubt

remove CrudService calls in favor of MNodeService