Defined and used permissions

Addresses https://github.com/my-koop/service.website/issues/346 for this module. Really did my best to be thorough and test different combinations of permissions, but I obviously couldn't test all of them.
we probably need 2 different endpoints to solve that actually. I would just comment this with a fixme with a link to an issue to solve that problem