Support permissions in model put/post

Revamp of #230 and rewrite of #235