check for :update_stories permission when rendering backlog story
disable dragging stories if no update_stories permission, pass permissions into frontend
check for update/create tasks/impediments, refine create story, pass permissions into frontend