Support permissions in model put/post

Revamp of #230 and rewrite of #235 

And it contributes to #107 since merging of permissions tests are performed out of webtest
This may need a comment I don't understand what's going on here.