Fixes #18763 -- Added with_perm to User manager.

Should be ready for a review.
I believe save() isn't required after adding permissions (M2M change)