Use ids instead of names for permissions.  Add support for plain authentication.