Add a simple permissions framework that uses django group names as permissions, and makes them lazily available as request.PERMISSIONS