A bunch of refactoring necessary to get JS working, but this will make permissions consistent and less error-prone for the future.