Currently our User Object is stored in an End User's session and is only reloaded in very special cases.

If an End User is granted new permissions by an Administrator that End User will have to logout and then re-login to get those permissions.

We should reload the user per request to avoid this hassle for the End User.

However, there are a few considerations when doing this:

There might be a much higher load on the database and we might need to implement caching (like though ehcache)

Perhaps there is a way to only reload users that we know will be changing?