Add complete user permissions check

We filled in User's hasPermission method. It properly checks the
permissions of each of the user's roles.