GDS::SSO::User already adds that line

which also won't work, because there's no
role attribute on User required to make
`attr_accessible ... as: :oauth` work.

wrote a test just to emphasize that
permissions is protected.