load permissions with custom UserProvider