Permissions for resolvers
Closes #94 (closed)
- add permissions to all restricted gql queries and mutations
- add tests for all restricted endpoints (except the ones defined in coko-server, which don't seem to be blocked by restrictions while testing; when running the app, restrictions work properly)