->permission() sanitizing: don't pass flags to ->permission()