Allocation-client subpage

[DO NOT MERGE] only for review
service here is passed in POST data? if it'll be passed in url, then we could use `service_permission` here too. If not, then we should write new decorator (or adjust the old one) for POST requests.