Move permissions statements into user example

This makes it self-contained

Shorten blog permissions to compensate

docs/examples/blog.md

@@ -48,31 +48,18 @@ comments (
 
 ### Permissions
 
-Basic table-level permissions. We'll add an the `authenticator`
+On top of the `authenticator` and `anon` access granted in the
-role which can't do anything itself other than switch into other
+previous example, blogs have an `author` role with extra permissions.
-roles as directed by JWT.
 
 ```sql
-create role anon;
 create role author;
-create role authenticator noinherit;
+grant author to authenticator;
-grant anon, author to authenticator;
 
-grant usage on schema public, basic_auth to anon, author;
+grant usage on schema public, basic_auth to author;
-
--- anon can create new logins and can read comments/posts
-grant insert on table basic_auth.users, basic_auth.tokens to anon;
-grant select on table pg_authid, basic_auth.users, posts, comments to anon;
-grant execute on function
-  login(text,text),
-  request_password_reset(text),
-  reset_password(text,uuid,text),
-  signup(text, text)
-  to anon;
 
 -- authors can edit comments/posts
 grant select, insert, update, delete
-  on basic_auth.tokens, basic_auth.users to anon, author;
+  on basic_auth.tokens, basic_auth.users to author;
 grant select, insert, update, delete
   on table users, posts, comments to author;
 grant usage, select on sequence posts_id_seq, comments_id_seq to author;

docs/examples/users.md

@@ -475,6 +475,30 @@ Remember that the `login` function set the claims `email` and `role`.
 You can modify `login` to set other claims as well if they are
 useful for your other SQL functions to reference later.
 
+### Permissions
+
+Basic table-level permissions. We'll add an the `authenticator`
+role which can't do anything itself other than switch into other
+roles as directed by JWT.
+
+```sql
+create role anon;
+create role authenticator noinherit;
+grant anon to authenticator;
+
+grant usage on schema public, basic_auth to anon;
+
+-- anon can create new logins
+grant insert on table basic_auth.users, basic_auth.tokens to anon;
+grant select on table pg_authid, basic_auth.users to anon;
+grant execute on function
+  login(text,text),
+  request_password_reset(text),
+  reset_password(text,uuid,text),
+  signup(text, text)
+  to anon;
+```
+
 ### Conclusion
 
 This section explained the implementation details for building a