small fixes
frontend routes permissions  + new bill permissions
implemented more frontend permissions and added them to backend routes