add additional permissions to users for editing assets

[stakach]

So the user editing doesn't have to be a system admin.
Similar to how staff-api deals with user permissions for say concierge access

Google doc on how permissions work

blocked by #183