can(user: Pick<PublicUser, "role"> | null | undefined,permission: Permission): boolean
Checks whether user has permission. A null user, for the signed out,
has none. The server checks again, so this only decides what to show.
user: Pick<PublicUser, "role"> | null | undefined
permission: Permission