rerefactor for populate psermissions into req.user