M permissions for user

1) Cleanup the permissions module by fetching permissions using only user data, including the `serverUrl`.

2) The auth-internal test needed to change its require path and while I was at it I changed the superfluous `internal` object to the CommonJS default `exports`.