Change grants/vetos location outside permissions

* Refactor code that expected +- form
* Add more tests
* Add reset permissions context on user endpoint