implemented rudimentary permission handling

this is just a rough first draft; neither elegant nor efficient (note
the inline comments)

also, the previously shared code in the `commands` module is now only
used by the "tags" twanager command - which means it can probably be
simplified somewhat