Extract permission checking as a separate aspect

Permission checking logic is about to get more complicated, so this
change extracts it to a separate aspect class, where it doesn't get
mixed up with validation logic.

Change-Id: Id1c718fdd233244537c51ec1802a25571671c91c
Bug: 163865561