wrapping up initial implementation of permission support (storing permissions in Stormpath)