Bug 1032772 - Badges pages don't load if you're not signed in

A check that req.session.user exists was missing before a call to permissionsModel, resulting in an error being thrown.
I'll defer to y'all on that.  permissionModel had a very stern error thrown about requiring a badge, action and user (so it is throwing a very descriptive error, at least).  I'm happy to change it to just deny permissions if the user isn't provided, though.