Permissions can't be mass-assigned

GDS::SSO::User makes permissions accessible
only for users with role :oauth. some of the
apps consuming this gem don't have a role field
defined on their User, and hence permissions is
protected. this change is to support such apps.