Per-view permissions

Support different permissions and ACLs per view (HTTP method). For example, `@service.get(permission="read")` and `@service.put(permission="write")`
I've just added some more tests to exercise this better.