massively updated how permissions are applied, both in the API and the UI - user roles now actually work as intended