Configure permission classes

[ghost]

Is your feature request related to a problem? Please describe.
Currently, users have full access to the API, excluding the students API so they cannot have access to fellow students.
However, they can also make a POST and update to the methods, meaning they can add courses or update their properties.
We should have this option to Admins and Contributors and not for a regular user.

Describe the solution you'd like
Manage permission classes in django ORM.

Describe alternatives you've considered

Additional context