handle various permission failures

- turn various EPERM, EACCES errors into 403
- add `writable` bool field to contents models
- if a notebook is not `writable`, save is disabled