Update user.md

updated with links.  removed some of the permissions... 
I think permissions should be taken care of server side..
Although what information is sent to determine permission level does need to be decided on