Return resource permissions in the API, and user this to show/hide action buttons in the UI

This add an 'allowed_methods' field to api responses. This tells us if the user has permission to GET/PUT/POST/DELETE this object.. we use this in the UI to show/hide post action buttons.

Slight weirdness is that we're returning permissions for POST which is only valid on whole collections, no individual resources/objects. I figure we can resolve this when add permissions to the current user api too, and then show/hide create post buttons - but thats a future task.