Make UI follow the permission model.

Permissions exist for the REST API; apply these checks to the UI as well.

User accounts with no permissions at all may still read all objects
and manually run status checks.