Wire permmissions for notifications, mail and tags

closes #2739

- wraps the api endpoints for mail, notifications, and tags in a canThis
  check
- add internal context to internal calls
- updates tests
Merge pull request #3312 from ErisDS/issue-2739-2

Wire permmissions for notifications, mail and tags