Advanced permission control

Would be nice to add support of advanced permission checking to `check_permissions` decorator.
Need to think about better way to do it. In general we need to support scopes queries like
```python
Or(And('read', 'write'), 'admin')
```

Start by reading the `check_permissions` decorator and how it currently evaluates permissions. Clarify the intended scope-expression semantics, including `Or(And('read', 'write'), 'admin')`, before identifying the affected implementation and tests. Done means advanced permission queries are supported with agreed behavior and covered by tests.

Written by the indexing model from the issue text.