Extract permission model.
Cleanup permissions.
Add permission model.
Rework permissions collection.
Refactor permissions and use in layout.
Secure /users.