User permissions stage 1

WIP but will branch from this if I get a LGTM.