Implement Permissions checks into Core

I may have missed some spots...
I'm not an expert, but I don't think this is approved web layout technique :)

No need to change now, just a candidate for future cleanup