Better authorisation mechanism

[ralovely]

Currently, we have 2 settings: allowed_create and allowed_receive
It needs to be more flexible:

• completely open: anyone can send to anyone covered
• completely closed: one company can send to only one company covered
• mono-directionnal: one company can send to anyone and anyone can send to only this company

The last one would be our main use case. We need any customer to send us secrets, ideally wihout having to manage it.

[mikel]

First lot of work on this done in #33