where wildcards can add some overhead is on LookupResources: since it needs to return all accessible resources, if you have many marked as public, then that means returning all of those as well