Use the new permissions format (Array)

This is (part of) paying off tech debt from when permissions was a Hash.

Note that I've used a migration to migrate the user data, so the deploy will need to be run with "deploy:migrations".