overload hasPermission: also accept domian-objects as params