Refactor document controllers to use permissions

This now only allows publishing and withdrawing by users with the
relevent permissions.
Use permissions to show/hide publish & withdraw

Users shouldn't be able to click publish or withdraw unless they have
the relevant permissions.
Testing new permissions workflow