Initial setup: User has profile, roles and app authentication. API has some permissions (not all of them yet, and basic endpoints