Ensure TokenUser.permissions is a set

The failure to make this a set caused tokens to be unable to issue other tokens.