* Return slice of permissions instead of slice of pointers for permissions
* Add access control metadata to search hits if access control query string is passed