Check read permission for HTML controller
Use bluebird as Promise polyfill only.
Add API endpoint for permissions
Simple permission edit and creation