better doc for object permissions, drop redundant has_permission call