move template to Twig, remove option to allow resource owner to (de)select permissions