use a set for flaskg.permissions for simpler code / slightly better efficiency