Add documentation for permission handling

This addresses #3 
It also adds a testcase, where several permutations are tested
against the proposed elasticsearch filter-query.