Allow for validation of more complicated permission/group schemes

[enygma]

Right now multiple calls are needed to get the user groups and permissions and ensure they have what they need. A way should be introduced, via some kind of schema, to allow checks for permissions/groups with various combinations of ands and ors (or even just permission/group sets).