Implement Permissions checks into Core

I may have missed some spots...
I initially had it be that latter, but changed it to application.authorize in order to more closely tie it to the application it's granting access to. I'm certainly open to reconsidering that though.