user class. This is set to the current page in SetPermission, which
must now be explicitly called rather than in the user class constructor.
SetPermission relies on page_owner function returning page and owner
variables which are found in the url parameter, so requests now all
return this.