Base permissions on usernames instead of host masks