Move user permissions to separate feature module