api/users: add permissions checks for write actions