Adding stages and authorisation

Some major changes.

• Callbacks have been replaced by stages and stage handlers.
• Object level authorisation is now built in.