Token has_perm handler (rebased)

**Replaces #656. Resolves issues #654 and #628.**