Token has_perm handler

This PR should fix #654 and #628 for now.