permission-manager: use js object instead of string_hashset internally