first pass, takes a username only and responds with name and permission