Set up remoting for add/remove

/to @bajtos 

See https://github.com/strongloop/loopback/issues/226
Is this really a `permission denied` error? Isn't it simply a bad request?

`Bad request: foreign key does not match the primary key`