refactoring permissions so they arent on the user object