The idea here is that IPermissionPolicy plugin writers shouldn't bother with taking the username and resource information from the perm cache. Rather, it's simpler for them to be presented with the `username`, `resource` and `perm` parameters directly. We also make the guarantee that `perm` matches the given `username` and `resource`.
