Make PERMISSION_CREATE work

This allows us to delegate the creation of permissions that match a glob
pattern.