Rename roles to permissions and generate an initial set.
Implement access control lists, fixes #31.