Add mergePermissions helper function

This merges dictionaries of permissions into the full list in
app.locals.permissions so that we can list it for administration.