Permissions are now bound to groups. GroupId added to global session to match user to their group when a session changes.

This is also the infrastructure for more fine tuned administrative
capabilities.