Implement Product permissions

[m4v15]

• [x] add permissioning on routes
• [x] fix the tests that break because of that
• [x] add a few more permissioning tests
• [x] update the docs

[mattlub]

@m4v15 nice one :ear_of_rice: