Add security hooks

[Malvolio]

Right now, the code assumes that everything under the "root" given your repo is supposed to be entirely public, every version of every file. Obviously, this isn't the case universally.

Instead, the config should also take two optional lambdas:

1. reference verifier: when a file is requested by tag or branch, this
   function will be called with the tag or branch name as an
   argument. If the function returns None, the request will be
   honored. If it returns a number, the request will be declined with
   that number as the status code (I expect 404 or 403 will be the
   usual status).
2. path verifier: whenever a file is requested (except through a
   blob-id), this function will be called with the path. The return
   will be interpreted as above.