Show UI elements according to permissions

Currently, Mailist shows all UI elements regardless of the user's permissions. Instead, it should only show actions that the user is permitted to, i.e.
- read only by default
- write access for users with create category permission
- admin for users with edit category permission

The same permissions must be enforced in the backend.