Fix a bug in User.has_permission()

Signed-off-by: Tyler O'Meara <Tyler@TylerOMeara.com>