Check permissions for menu points/routes

the "legal entities" menu point seems to be always visible (and the respective route thus accesible) despite the user not having the permission to access the said page.

In general, no rules.py is present.