Relates to #58 and #59

This adds permission checks to endpoints and the new upstream user type

This breaks _all_ urls in the project. Upgrading to this change needs to be coordinated,
as webpage, client, backend and the puppet config need to be upgraded in tandem.