RequirePermission now passes "warning" when permission is
denied
global error handler detects API requests and renders them as JSON
instead of HTML