make permission manager transient to avoid tomcat serialization issues