This method is what is called from `JcrSession.hasPermission`, so it would be great if this were able to be shortcut for the frequent case where there are no ACLs. Perhaps, the `hasPrivileges(...)` call (several lines down) can be changed so that this method immediately looks up the ACLs and (if there are some) builds the Privilege[] and then passes the privileges and the ACLs into the `hasPrivileges` call?