that, in fact, does it as a single check, because it can rewrite and make sure the token's user ALSO has the resource's view perm