permission rules for JSON + web controllers, for an authenticated User

User Session management: /j/user/session
- list of attributes
- attribute setter
- expiration interval setter

User Settings (persisted in DB): /j/user/settings

CSVs for User Settings
Merge remote-tracking branch 'origin/master'