[AI-506] Fixed problem with permission checking

Hibernate filters were hiding the UserPermission records we need
to assess whether a user is authorized.

In general Hibernate filters have turned out to be
pretty awful, as they make it very difficult to reason
about code.

I've removed the filters for UserPermission and added an
explict check in GetUsersHandler, and we should remove
the remainng filters as we have time to test.