add simple perm system draft
update readme
disable buttons, if not leader
check membership request permission #20