Permissions: STD-28

This locks down saving/publishing/trashing on the api endpoints. Let's interface.