I thought about separating permissions in `mkt.api.permissions`, yeah. I think this should be done in a separate cleanup pull request afterwards, that'd just complicate things in this one.