Break user affiliation permissions out

This will be a little easier to reuse. The problem was that we kept
having to check if user was nil and return `[:faculty, :trustee]` if it
was. This takes care of that.