With distinct permissions, we don't need to check ~ 100 000 permissions to check if someone can log in
