small fixes in service layer, added first version of granting and
revoking object permissions