Add permissions output to API

This exposes permissions in the API. At the moment a flat list is
returned, showing all permissions a user has and which group granted
them.