added branch_permissions to nested user objects