Added without_permission(user, permission) method. Modified with_permission_sql so it can also accept a user_id as a first argument