Bug 1032772 - Badges pages don't load if you're not signed in

A check that req.session.user exists was missing before a call to permissionsModel, resulting in an error being thrown.
Should this check be put inside the permissions model, so we don't run into this error again?