Fix multiple permission criteria in the auth plugin (fixes #2)