User.js fixed missing perms var