Permit login with blank scope

Required for the editor, which doesn't know the appropriate scope
for the user logging in. The user will adopt their default permission
scope once logged in.

red/api/auth/permissions.js

@@ -32,11 +32,15 @@ function hasPermission(userScope,permission) {
         }
         return true;
     }
-    
-    if (userScope == "*") {
+
+    if (permission === "") {
         return true;
     }
-    
+
+    if (userScope === "*") {
+        return true;
+    }
+
     if (util.isArray(permission)) {
         for (i=0;i<permission.length;i++) {
             if (!hasPermission(userScope,permission[i])) {
@@ -45,8 +49,8 @@ function hasPermission(userScope,permission) {
         }
         return true;
     }
-    
-    if (userScope == "read") {
+
+    if (userScope === "read") {
         return readRE.test(permission);
     } else {
         return false; // anything not allowed is disallowed

red/api/auth/strategies.js

@@ -85,6 +85,9 @@ var passwordTokenExchange = function(client, username, password, scope, done) {
 
     Users.authenticate(username,password).then(function(user) {
         if (user) {
+            if (scope === "") {
+                scope = user.permissions;
+            }
             if (permissions.hasPermission(user.permissions,scope)) {
                 loginAttempts = loginAttempts.filter(function(logEntry) {
                     return logEntry.user !== username;