Implement Permissions checks into Core

I may have missed some spots...
I have slight misgivings about adding wildcard matching here. Potentially a little bit confusing that we have permission-strings with stars in them granting many permissions under one usage, and accepting many strings in another.

renaming "wild" to something more descriptive here might help ("accept_any_matching" or something? low on good ideas)