the magic to collect permissions "as you decorate"

Uses a signal and callback for the UserForm to update the choices
once per decorated function. The choices can't be set in the class
attribute anymore as this is only evaluated once, but instead have
to be bound to the instance, which is why the ctor is extended.