permission mixin for user classes