menu: added support for permissions, preparing for new module API