Add GET /models endpoint.

Caution when rebasing `acls` is now permissions