Enforce permissions on server side when changing permissions.

Also updated some comments.