add permission handling to REST resources

store permissions for users
change REST interface for user authentication, creation and listing all existing users (from mongodb only, currently)