refactor permissions and roles out of models/auth. auth is easier to import; functions are now in util.