@classmethod
def validate_user(cls, req):
    """hook method to allow <app>.User subclass to override the default validation and permit setting"""
    req.user = cls.validated_user(req)
    req.user.get_permits()
