Add documentation for permission handling

This also adds a testcase, where several permutations are tested
against the proposed elasticsearch filter-query.
Fix grammar