move currentUser to session and use it to access permissions
allow supervisors to start reviews
fix 'On restricted page doesn't redirect if staff' test
fix issue accessing session.currentUser properties
merge with permissions_refactor