in the common case, the vast majority of callers will be okay with a permission check that is a few seconds out of date