Refactor the Permission checking decorators

This fixes a couple of bugs, mainly centered around the fact that if we're checking for any permission of the form 'core.group.*', then the user having 'core.*' should pass evaluation.