Remove global permissions when no user and no client (because that's a terrible idea)
Abstract common permission checking code into a function
Add a DRF permission class for checking data permissions
Initialize data permissions on all existing datasets and clients