Permissions endpoints + tests

Tests for #17