improve 'plans' serializers, views and add permissions