Fix Permission.is_allowed to correctly check permissions