Remove use of deprecated Claim.getPermissions. (non-api deprecation)