grab a fresh ID before performing changeops

This also refactors getRequiredPermissions
to take EntityContent instead of Entity

Change-Id: I8524e781909c7654bcbc7d3b92c0f7fe57dd3c95
Merge "grab a fresh ID before performing changeops"