add permissions to device and tree models. fixes #30