Move permissions to models/login.go.