Remove duplication with default user info
Remove permissions from session in most cases

* Only `login.noop` checks the session for permissions, and this is due
  to behave tests needing to assert permissions across multiple
  requests (and is now handled in a `before_request` callback only in
  `login.noop` module).
Merge remote-tracking branch 'origin/develop' into feature/remove-permissions-from-session
Merge pull request #762 from reciprocity/feature/remove-permissions-from-session

Remove permissions from session in most cases