Check for any permissions before holding any sf locks

Also fixes an incorrect permissions check in setClientState to
check a cached value since it is now called on the main thread.

Test: presubmit tests
Fixes: 180180131

Change-Id: I87f2dc0683780166fec8738265c74d8d706a8575