add observer to the permissions query. this should not be necessary but it makes it clear why it should be included in the cache key (cherry picked from commit 57e32a79)