added SendEmails permissions
limit what gets shown to the user by scopes

this doesn't actually prevent them from doing anything, but it does keep
less-able hackers out xD I'll finish the actual stop stuff in the
backend tonight