Add route permissions guard

First commit to add permissions check on route, as discussed in #182

Discussin is open, tests to come
I honestly find it confusing. "admin" is typically not a "permission", it's just a role. Typical permissions that admin may have is something like "post.delete_others". We already had this discussion and we came to the conclusion that this is the cleanest way to solve this problem. Then the admin have both "post.delete" and "post.delete_others" permissions while normal users only have "post.delete".