add basic permissions system

add a permissions collection to master db and use this to determine if a
logged in user can edit an instance.
on request setup add a permissions object to the req and locals which
only contains a can_edit_instance property at the moment but cuold be
expanded in future
Also update the templates to use this