don't store user permissions in database - Theo's Typesafe Cult