[API] Permissions should handle missing limitations gracefully

Some limitations are not implemented yet (like NewState), others that
are only relevant for legacy newer will be (ezjscore ajax call related).
So Permission checks should handle this and make sure that missing
limitation is threated as a "no access" instead of letting the exception
true.

- [x] todo: unit test

test + review ping @gggeek, @efernandes
review ping @pspanja