Use the Drupal 7 permissions API

Plus finer granularity access control

Change-Id: Ie7e360fc60e9ea64e5a859e655a73f8497d60e30