Implement Permissions checks into Core

I may have missed some spots...
I'm still worried about mutating the app's short. This feels like it could lead to a lot of stale permissions in the DB, and permissions that people had going bad.