Save permissions during model creation

Requires #234 

* [x] Use validated['permissions'] in views
* [ ] Default permissions if not specified
* [ ] Merge permissions if specified (always give ALL to owner)