Allow extra permissions to be specified when adding users.
Check authorization before patch submission and merging.