Implement Permissions checks into Core

I may have missed some spots...
It'll be the application's id (the one used by the API as an identifier, etc.), though I suppose it might be worth changing that to the application's short, that would break from the tradition of using id's for permissions (accounts, characters, groups, etc.).