By incorrectly I mean it was using incorrect combination of
list_user_permissions command which was making the LWRP to be
NON-idempotent and was setting the permissions when they already
have been set. According to docs the correct commands are:
list_user_permissions [-p <vhostpath>] <username>
ie. you MUST supply the username as it's a mandatory argument.