Add permissions checks to ways and relations. Change forbidden API message to be more verbose