Set user in headers, returned permissions after check

1) intra_system_get doesn't seem to set the cookie for the current user
(they show as anonymous on the other side of the get.
2) if the user had permissions on all resources we were their
permissions on ac which isn't right.  I changed it to return full
permissions.