Fix Permissions

- Permissions were implemented but not applied to every service. It is fixed now.
- A `modelId` field has been added to *File* to protect them: only *Users* with read (resp. write) rights on the corresponding *Model* can read (resp. write) the *File*.
    - TODO : Add `modelId` parameter to the `POST /api/files` requests client-side (@johannes-baldinger)
- `file` and `thumbnail` fields of *File* are now `ObjectID` and not `String` anymore.
    - It shouldn't affect anything (it just makes the DB cleaner). The DB should be dropped/reset (previous entrances won't work anymore)