Return full rights in /users/{userid}/rights.json (update)