Remove mention of right, replace by permission
Clarify building of token_permissions from principals