Fill missing reply permissions

Introducing user service.
- Stores persona.
- Handles building/destroying Permissions and Auth plugins (moved from AppController)
- Privacy directive uses it.

Fix #1759
The replies permissions were not filled, only the reading permissions
because privacy directive used to fill the rest. But a change made it not to touch the permissions of an annotation which has the permissions already set.


I tend to keep these alphabetized, so it's easy to find the things. That's one benefit of dependency injection over positional arguments.