Fill missing reply permissions

Introducing user service.
- Stores persona.
- Handles building/destroying Permissions and Auth plugins (moved from AppController)
- Privacy directive uses it.

Fix #1759
The replies permissions were not filled, only the reading permissions
because privacy directive used to fill the rest. But a change made it not to touch the permissions of an annotation which has the permissions already set.


This service is doing too much. The identity service has `.logout()` and `.request()`. The auth service should not have `.login()` or `.logout()`.

It should start with a `user` property that is undefined. It should use the Auth plugin to get a token and set the user from the token on login. It should set the user to null on logout.

I said something about a promise in my last comment the other day, but I think I was wrong. There's no need for any promises here.

The only public attributes/API on the auth services need to be `.user` and `.permits()`.