add basic permissions system

add a permissions collection to master db and use this to determine if a
logged in user can edit an instance.
on request setup add a permissions object to the req and locals which
only contains a can_edit_instance property at the moment but cuold be
expanded in future
Also update the templates to use this
store the permissions in an object in the collection

That way we can have multiple permissions for each user/instance
relationship
POC version of admin accounts list page