Restrict the permissions of registered applications

[Crsi]

Currently, the API is designed in an all-or-nothing way. It would be really great if the scope of applications could be limited somehow. The current suggestion is to introduce three different "levels" of power for an application (besides the zero-power level without any authentication):

• read allows an application to query the GET endpoints of the server, but any POST/PUT/DELETE call will be rejected with a 403 error
• limited allows an application to perform all read (see above) and some write commands, e.g. creating a user alias or accepting a user alias confirmation request, but no commands where actual money could be transferred (e.g. by communisms, refunds or transactions); all such restricted queries will be rejected with a 403 error
• all uses the old behavior and allows an application to use all endpoints