user.permissions is now user.role