Permission system is too simplistic

[czosel]

Currently, there is e.g. no way to say that someone can read / merge templates, but can't write / delete them. I think we should either add new configuration options for this, or introduce a full permission/visibility system as we have in other APIs.

[open-dynaMIX]

Proposal

Integrate django-generic-api-permissions for custom permissions.

However, since this would be breaking, there are two was of moving forward:

1. We add a basic permission class that implements the same permission layer that exists right now (request path and group xpath config) and use this as a default. That way it could be implemented in a non-breaking way.
2. Drop the current permission API, as it's basically just authorization without any authentication.