Respect user permissions in get_user_defaults

Permission filter in get_user_defaults was discarding results; now properly prevents auto-setting default values that the user has no User Permission for.