User permissions stored in <req.session.userPermissions>