Looking at `user_has_perm` below, it looks like implications are resolved using a linear scan of the list of implied permissions. Should these be sets instead?