Password encryption service can be called before PostConstruct
Avoid checking for existing permission since SecurityFeatures#init might not have run;  make newPermissionNoCheck idempotent