Fill missing reply permissions

Introducing user service.
- Stores persona.
- Handles building/destroying Permissions and Auth plugins (moved from AppController)
- Privacy directive uses it.

Fix #1759
The replies permissions were not filled, only the reading permissions
because privacy directive used to fill the rest. But a change made it not to touch the permissions of an annotation which has the permissions already set.


It's a watch, but one watch is no big deal. I would prefer that since it simplifies the auth service _a lot_, I think. You don't need the promises or an API.