properly stringifies permissions, yay!