User permissions stage 1

WIP but will branch from this if I get a LGTM.
console.log ... get outta here