Implement proper React route permissions

Route permissions are currently undocumented and not in a stable state.

We should automate the subuser permissions system, which wouldn't require any developer implementation (similar to route eggs). Developers who would want to create custom permissions, should be able to do so as well. Permissions shouldn't have the ability to conflict with other extensions.