Use user object from session to compute permission when using 'hasPerm' in