Store serverUrl on the user

We now store the serverUrl on the user so that non-delegate modules can know what to do.
ergghhh. It still seems so redundant to have both collection.environment and opts.serverUrl in here. They will always match up. You'll never have a qa collection but be requesting permissions against prod serverUrl