Not sure why we changed the order of `action` and `obj` in the has_access method.  But note that the 3rd parameter `obj` is also allowed to be a string.