Remove permissions from session in most cases

* Only `login.noop` checks the session for permissions, and this is due
  to behave tests needing to assert permissions across multiple
  requests (and is now handled in a `before_request` callback only in
  `login.noop` module).