Add a canAdd, canEdit and canDelete setting on users

[neilenns]

They should add/remove the icons from the app, as well as block tap and hold. Don't forget to enforce on the server side as well.