Implement Permissions checks into Core

I may have missed some spots...
err, I didn't really intend to push that into the PR... but either way, it was what was causing the issue on /account/register (though it was being used by the application editing interface so, TODO: fix that in a future PR)