Update TODO and Roadmap
Add get_user_permissions method to models.collection, and test cases