687 authorization api

Implemented as a permissions API call (*/api/2/permissions*). Returns something like:

```json
{
    "create": false,
    "read": true,
    "update": false,
    "delete": false
}
```

Fixes #687