Add better permission handling

[freezy]

Instead of just hiding links, also check on the page if the user has the permission to use it instead of relying on the backend to refuse.

Also behave accordingly if the user's access token is for some reason invalid.