Permissions to map user -> buckets

Previously it was a bucket -> list of users

@alexmuller
@pbadenski