Pros/cons on computing this user permission in a Java layer rather than in the XSLT?  I hope we can march bit by bit towards an XSLT that contains policy logic and is only about rendering pre-digested model?