obj is optional for user_has_perm()