Changes:

1. Callback for custom permissions path can now return explicit boolean false to have Rbac checking skipped
2. MongoCollection will return its path db-name/collection/sub-collection/... with the method getRbacPath()