Docs tweaks
Better encapsulate some of the gorier details of permissions checking
Create a new GlobalPermissionSet class to encapsulate the global
permission data, using an underlying HashMultiMap. This is a bit
cleaner, but more cleanups will be made in future. Also, serialization
and deserialization can be moved into the class.