add POST endpoint for permissions
start moving visibility in the direction of using permissions versus hardcoded rules
create permissions with claim and matcher
use 'admin' permission for principal updates and make principal able to admin themselves by default.