Moved all permissions checks back over to the endpoint definitions, and made permission definitions mandatory.

In places that we haven't decided how to handle yet, I've used a
'.nopermissionsyet' declaration which logs an annoying message.  Maybe
TOO annoying.  Not sure.

I've left one test disabled because I'm not sure what we want to do
about anonymous users creating accounts.  Currently they can, and
that's useful for testing, but in the long term maybe we shouldn't
allow this.