Update authmanager to check for specific privs

[AnnaGerber]

At the moment we are assuming that accounts have privs for ORE + annos by default: so ORE privs are not being checked. Eventually we'll want to support accounts for annotations or compound objects only, so these should be individually checked.