Permissions endpoints + tests

Tests for #7