Refactored UserSerializer
UserPermissions is now in User API