constants, users, settings, permissions(see desc)

moved constants to separate file, updated users model, fixed user
setting issue, added object-level permission on user settings