Rewrite [check_function_call] using [Permissions.sub].
Fix silly mistake.

Only one third of the tests fail, that's not too bad.
Add a comment.

There's a reason why the code doesn't work. The algorithm is slightly wrong.
The algorithm is now correct.

Of course, a majority of tests (all the significant ones) still fails. This was
just a proof-of-concept anyway.