DW: Added datadictionary permissions and checked role using issubset of the...

... configured permission
OK, that makes sense, that also explains using `reverse`, so that roles with more permissions are checked first.