Core pr 6

New permission and some logic rewrite based on review from PR5.
Not in scope for this pull request but we should use [`drupal_get_messages($type, TRUE)`](https://api.drupal.org/api/drupal/includes%21bootstrap.inc/function/drupal_get_messages/7) for this. There is no need to invoke the theme layer.