Workings on Permissions

* Extracted an interface from PermissionProvider to allow multiple
and eventually plugin-level exchangable permission provider implementations

* refined permission lookup again so hasPath will take into account asterisks,
which it wasn't doing, possibly causing derplings

* Rewrote the addPath algo to be a bit more effective