Clarify how permission classes are composed

It wasn't clear to be how these permission classes were composed (with AND or OR), so I added a sentence to the docs!