allow setting custom PermissionFactory implementations

fixes #20