Check that different user groups have the correct rights to backend routes, and that user right documentation is up to date

[juhanikat]