perms: refactor perms config to make interface much clearer
'perms_policy' is a callback which returns a Perms object, which may
filter cdx lines from the response