Refactor AuthCandidate: Add #current_user method
Apps without `permissions` scope can't set permissions