Implement Permissions checks into Core

I may have missed some spots...
This is going to have the prefix problem (an app with short "app" will match permissions for "app." and "application."). Retrieving an application's permissions should be a model-level method (not sure whether on Permission or on Application)