Authorization

[jgonggrijp]

Fine-grained permissions, possibly using Flask-User.

[jgonggrijp]

Probably not using Flask-User. Let's for now take an all-or-nothing approach (i.e., postpone this issue) and decide later what kind of permission structure is needed.