Implement GET /api/users/{user}/permissions

Fixes #33.
go fmt