A user with no Gameplan role sees onboarding instead of a 403

SPA now correctly renders 403 errors instead of showing onboarding; permission queries fixed to check user roles before returning empty list.