user: implement master merge correctly in get_all_permissions()