Use the Drupal 7 permissions API

Plus finer granularity access control

Change-Id: Ie7e360fc60e9ea64e5a859e655a73f8497d60e30
Merge remote-tracking branch 'origin/master' into HEAD

* Use the Drupal 7 permissions API