Add user permission + futures endpoints

This adds endpoints for setting user_permission overrides and adding
futures to schedule permission changes.

See the added docstring for the details on how the API works.

Also in this commit are some other closely related changes:
- DRY out the `need_blinding` code by adding a context manager for
  blinded User retrieval.  (The resulting indent adds a lot of code
  churn; ignore-whitespace-diff recommended for sanity)
- renamed permInfo and futurePermInfo (in endpoint names) to permissions
  and futurePermissions so that they are consistent with the new POST
  endpoint names for assigning permissions/futures.
- added GET /room/R/permissions/SESSIONID and
  /room/R/futurePermissions/SESSIONID endpoints that return the
  permissions and future permissions for a single session id.  (These
  share the same name with the POST endpoints that assign, and were
  cheap to add).
- make sure everything works through blinding transitions (i.e. you can
  specify an unblinded ID and properly adjust the *blinded* user).
- sort future permission retrieval by `at` time to make sure the
  response is deterministic.
- Added a bunch of tests

Author: jagerman