Explicit permissions for file access

[susnux]

As an example the IRootFolder has the method getByIdInPath,
this tries to infer the user from the path and fallsback to the current user or otherwise the owner of the file to estimate the view onto the file.

Ideally our APIs would be explicit:

• Do not infer user from session
• Explicitly pass the user as a parameter
  • if you want to use the session the explicitly fetch the user from session as pass it