Update permission.js

[dioptre]

Setting default read for everything and making it hard to change is bad, especially after loading large user sets.

[ryanwilliamquinn]

I think an option where you can pass in a config might be a better solution. So you can specify in config/permissions.js that you want registered to have no permissions by default.

module.exports.permissions = {
    grant: {
        registered: []
    }
}