authentication: user model's permission_level fix