Introduce a basic application context (#488)

This is a minimal but effective skeleton for having per-request context information that can be used for permission checking.

It introduces context vars that are scoped within the request, be it sync or async.