Added permissions classes, as well as updated the view to only use
"staff" permissions. Staff can always create, update, and remove,
and other users can only view.