handle various permission failures

- turn various EPERM, EACCES errors into 403
- add `writable` bool field to contents models
- if a notebook is not `writable`, save is disabled
s/open_w/atomic_writing/
Merge pull request #6903 from minrk/writable

handle various permission failures