Permission handling

- implement permission handling
- implement token check for every api endpoint
- housekeeping