Use a permission mixin to check for permissions in views

This makes sure that for all access to the class the permission is
checked and gets rid of all thos decorators in the urls.py files
Rename mixin to be more consistent with the other generic views