Cleanup global state logic a bit, for current user and permissions

this still isn't ideal perhaps, but leaves some clues for improvement

src/components/app/ByjoveApp.vue

@@ -20,7 +20,11 @@ export default {
     props: {
         appsettings: Object,
     },
-    created: function() {
+    beforeCreate: function() {
+
+        // TODO: even with beforeCreate() this logic is still happening "too
+        // slowly" for us to reliably check perms on first page load,
+        // i.e. after browser refresh.  maybe can avoid async for the GET?
 
         // when main app is first created, fetch user session data from
         // backend; this will tell us who the user is (or if they're not yet
@@ -30,10 +34,10 @@ export default {
         this.$http.get('/api/session').then(response => {
 
             // let all of app know who the user is(n't)
-            this.$store.commit('setUser', response.data.user)
+            this.$store.commit('SET_USER', response.data.user)
 
             // also keep track of user's permissions
-            this.$store.commit('setPermissions', response.data.permissions)
+            this.$store.commit('SET_PERMISSIONS', response.data.permissions)
 
             // if user is anonymous, and requested logout page, send to login instead
             if (!response.data.user && this.$route.name == 'logout') {
@@ -47,10 +51,6 @@ export default {
     },
     mounted: function () {
 
-        // // cache the app version
-        // // this.$store.commit('setAppVersion', appsettings.version);
-        // this.$store.commit('setAppVersion', this.appsettings.version);
-
         // add "testing" watermark unless running in production mode
         // if (!appsettings.production) {
         if (!this.appsettings.production) {