xform share api endpoint

With this I would really want to follow a specific order, ideally starting from `readonly` to `owner` being last. Otherwise it will always fail when the previous permission was of a superset of the current one.