Rewrite `signed_in` decorator as to accept permissions

- This is just a simple minded parameterised decorator function
- Accepts a list of permissions, defaults to `['signin']` if set to None