Refactor API views a bit for sake of running as separate service

also add "proper" (sic) permission checks

tailbone/api/users.py

@@ -30,12 +30,12 @@ import six
 
 from rattail.db import model
 
-from cornice.resource import resource
+from cornice.resource import resource, view
 
 from tailbone.api import APIMasterView
 
 
-@resource(collection_path='/api/users', path='/api/users/{uuid}')
+@resource(collection_path='/users', path='/users/{uuid}')
 class UserView(APIMasterView):
 
     model_class = model.User
@@ -46,6 +46,14 @@ class UserView(APIMasterView):
             'person': six.text_type(user.person or ''),
         }
 
+    @view(permission='users.list')
+    def collection_get(self):
+        return self._collection_get()
+
+    @view(permission='users.view')
+    def get(self):
+        return self._get()
+
 
 def includeme(config):
     config.scan(__name__)