extract logging of failed permissions into shutdown hook

This allows us to combine the messages for each ProtectionDomain.