I think this should check for the 'signin' permission before adding the 'editor' permission.  It's likely that there will be Permission records for users with an empty array of permissions.