AuthenticatedHandler.user_has_permission