Part of #4055
Change method naming to snake_case and implement initial `current_user_can()` permission checks