check and return users permission

[liunicholas]

return array of available endpoints

[aaronrudkin]

Assume there's an API called /api/endpoints/ and it returns {"endpoints": ["endpoint1", "endpoint2", ...]}. If a user does not send a token or the token is invalid this will be empty. Handle the response accordingly and we'll make the API work. Note that this will not return a response inside {"data": } so it'll be a little different than the data endpoints.