Applying new permissions system to the very broad permission checks we currently have + fixing up some roles and permissions configuration

[skip ci]