Make those calls go through Tank Auth method instead of hitting the session directly.
Rename `permit` to `has_permission`.