Make permission retrieval a direct remote action (do not send them as part of status)
Load permissions via a store
Add a Permissions developer panel