# Buggy code
def _find_required_permission(self, request, service):
    """Find out what is the permission object id and the required
    permission.

    .. note::
        This method saves an attribute ``self.current_record`` used
        in :class:`kinto.core.resource.UserResource`.
    """
    # By default, it's a URI a and permission associated to the method.
    permission_object_id = self.get_permission_object_id(request)
    method = request.method.lower()
    required_permission = self.method_permissions.get(method)

    # For create permission, the object id is the plural endpoint.
    collection_path = service.collection_path.format(**request.matchdict)

    # In the case of a "PUT", check if the targetted record already
    # exists, return "write" if it does, "create" otherwise.
    if request.method.lower() == "put":
        resource = service.resource(request=request, context=self)
        try:
            record = resource.model.get_record(resource.record_id)
            # Save a reference, to avoid refetching from storage in
            # resource.
            self.current_record = record
        except storage_exceptions.RecordNotFoundError:
            # The record does not exist, the permission to create on
            # the related collection is required.
            permission_object_id = collection_path
            required_permission = "create"
        else:
            # For safe creations, the user needs a create permission.
            # See Kinto/kinto#792
            if request.headers.get("If-None-Match") == "*":
                permission_object_id = collection_path
                required_permission = "create"
            else:
                required_permission = "write"

    return (permission_object_id, required_permission)


# Traceback (nUnicodeEncodeError)
{"Pid":3109,"EnvVersion":"2.0","Hostname":"ip-172-31-2-114","Timestamp":1479738668906000000,"Fields":{"lang":null,"exception":"Traceback (most recent call last):\n  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/pyramid\/tweens.py\", line 22, in excview_tween\n    response = handler(request)\n  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/pyramid_tm\/__init__.py\", line 109, in tm_tween\n    reraise(*exc_info)\n  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/pyramid_tm\/__init__.py\", line 88, in tm_tween\n    response = handler(request)\n  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/pyramid\/router.py\", line 127, in handle_request\n    root = root_factory(request)\n  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/kinto\/core\/authorization.py\", line 144, in __init__\n    self._find_required_permission(request, service))\n  File \"\/data\/kinto-dist\/lib\/python2.7\/site-packages\/kinto\/core\/authorization.py\", line 237, in _find_required_permission\n    collection_path = service.collection_path.format(**request.matchdict)\nUnicodeEncodeError: 'ascii' codec can't encode characters in position 5-6: ordinal not in range(128)","uid":null,"errno":null,"querystring":"{}","agent":"Amazon CloudFront","method":"GET","path":"\/v1\/buckets\/block%C2%93%C2%96sts\/collections\/certificates","authn_type":null},"Logger":"kinto","Type":["ascii","block\u0093\u0096sts",5,7,"ordinal not in range(128)"],"Severity":2}

# Fixed code
def _find_required_permission(self, request, service):
    """Find out what is the permission object id and the required
    permission.

    .. note::
        This method saves an attribute ``self.current_record`` used
        in :class:`kinto.core.resource.UserResource`.
    """
    # By default, it's a URI a and permission associated to the method.
    permission_object_id = self.get_permission_object_id(request)
    method = request.method.lower()
    required_permission = self.method_permissions.get(method)

    # For create permission, the object id is the plural endpoint.
    collection_path = six.text_type(service.collection_path)
    collection_path = collection_path.format(**request.matchdict)

    # In the case of a "PUT", check if the targetted record already
    # exists, return "write" if it does, "create" otherwise.
    if request.method.lower() == "put":
        resource = service.resource(request=request, context=self)
        try:
            record = resource.model.get_record(resource.record_id)
            # Save a reference, to avoid refetching from storage in
            # resource.
            self.current_record = record
        except storage_exceptions.RecordNotFoundError:
            # The record does not exist, the permission to create on
            # the related collection is required.
            permission_object_id = collection_path
            required_permission = "create"
        else:
            # For safe creations, the user needs a create permission.
            # See Kinto/kinto#792
            if request.headers.get("If-None-Match") == "*":
                permission_object_id = collection_path
                required_permission = "create"
            else:
                required_permission = "write"

    return (permission_object_id, required_permission)