New endpoint created to accept a `Permission`.

- The client will only ever have the activationCode when users click the link sent to them, so a special endpoint receiving that code makes sense for the update/accept