Handler now respects wildcard permissions