More work on user management, added "controlDevices"-permission (#260)