Tyr: User api didn't return the real authorizations

http://jira.canaltp.fr/browse/NAVITIAII-911

The List field didn't read through all authorizations (queryObject) appropriately.
We get arround that by replacing it by a list via the lazy property set to
joined. The delete operation has to be modified since it was no longer
possible to search the correct Authorization by a query.