Implement Permissions checks into Core

I may have missed some spots...
We probably want to verify that the app short is unique before creating the corresponding permissions