What are two mechanisms for storing user permissions to enable administration security on the Web Console?