Support permissions in model put/post

Revamp of #230 and rewrite of #235 

And it contributes to #107 since merging of permissions tests are performed out of webtest
The essence of this PR is in this line :)

The rest is refactoring :)