Read doc and field-level permissions from the client

Adds useUserRoles and enhanced useDoctypeMeta for SPA frameworks to check permissions without boot data.