PLINK-268 refactor, moved permission handlers into API package