Front-end permissions (WIP)

TODO: update documentation to cover the new route/serve API