add more permissions to REST resources

adds helper methods in RestResource base class for checking per-instance permissions, see DashboardsResource for examples

issue #244