can(payload: AuthPayload,permission: Permission): boolean
Checks whether the caller's role grants permission. The role is the live
one authenticate put in the payload, not the token's.
payload: AuthPayload
permission: Permission