optimize lookup

* store a hash for quick indexing into permissions by action
* remove complicated logic in matches_subject_class?
* inline logic for matches_subject?