Add route permissions guard

First commit to add permissions check on route, as discussed in #182

Discussin is open, tests to come
Once again I feel the tests confusing because "admin" is not really a permission but rather a role. As I also see tests as a kind of documentation, we should use something that looks like a permission, like "read", "write", "delete"...