Access is now done through a list of access lists, instead of the necessary/sufficient system that was extremely confusing.
Added a "deny" list so you can screw over sec.
Cleaned the API up so it all uses sets and such.
PDA now relays access read-only to fix edge cases.
