Bug 1013321 - Ensured permissions are correct before sending them to the middleware.

@peterbe The solution I proposed yesterday was fighting the right problem but in a wrong way. Instead of sanitizing data after getting it from the database, we need to sanitize it before it gets there. That's what I'm doing here, and I thus reverted my previous commit. If an error occurs in the API or in Super Search, that means the data that was put in the database was incorrect and that we made a mistake in validating it. 
`return [x for x in values if x in all_permissions]` maybe