Permissions UI

Among other things, fixes #482 and #450.
Publication needs to be loaded on the client (and not just to know its ID), because below you are creating a local annotation and ```createAnnotationDocument``` will try and load the publication as one of the local annotation's fields. Therefore the first time around that field was null and so we actually created two local annotations, one with publication null and second one with publication filled out. By doing this change it prevents to create the first annotation with missing data.