ds xacml checks

This... could break, if there were any other permission checks on the same op/pid/user combo, as the result of denying a datastream.