User permission system

Implements the user permission system discussed in https://github.com/my-koop/service.website/issues/224. Does not implement the advanced permission mask system discussed towards the end, that will be done as a part of https://github.com/my-koop/service.website/issues/277.

Permissions for the front-end routes (https://github.com/my-koop/service.website/issues/157) will also be done separately.


while we're there, might as well add the `hash` field for #53