Fixing issues with client-side permission enforcement (as well as permissions serialization)