Add permissions checking to all API calls

All API calls now feature a function `CheckPermission(User user, string action)`.  This function is called by the `HttpProcessor.ApiProcess()` function, after all authentication checks, to verify that the user is capable of performing the action they are attempting.

Read-only handlers will always return true for permissions, unless we decide that they should not.  Read/write API handlers have permission levels set up, and then the user's permission level is checked against the level required for each action.