Create an endpoint to check if a user has access to an instance

[chiatt]

To avoid hard-coding permission types in the front end like this we should instead have an endpoint that takes a user, and instanceid, and permission type(s), and checks if a user has that access. This would allow the permission framework to determine access rather than trying to do it in the browser.