M permissions for user

1) Cleanup the permissions module by fetching permissions using user and user data, including the serverUrl.

2) The auth-internal test needed to change its require path and while I was at it I changed the superfluous internal object to the CommonJS default exports.