Store serverUrl on the user

We now store the serverUrl on the user so that non-delegate modules can know what to do.
good points. Basically this function supports multiple use cases. 

1) I have a token and a collection.

2) I have a token and a serverUrl.

I think we can change the semantics and parameters by have this become `permissions.forUser`, and a user is provided with a serverUrl. The collection doesn't need to factor into this at all.

I am regarding the serverUrl as the source of truth for env. 

Thanks for comments!