Lockdown user model permissions

Nice work by the way! Looks super nice.