user: add Permission class, and User.has_permission() (ref #8)