Implement permission checking.

Basically, ops can only set release and timeout locations now.
Adding mooshroom to the list of friendlies.